RewardsWP – Loyalty Points & Referral Program for WooCommerce Security & Risk Analysis

wordpress.org/plugins/rewardswp

Turn customers into brand advocates with loyalty points and referral programs for WooCommerce and Easy Digital Downloads.

90 active installs v1.0.6 PHP 7.4+ WP 6.0+ Updated Mar 2, 2026
loyaltypointsreferralsrewardswoocommerce
100
A · Safe
CVEs total0
Unpatched0
Last CVENever
Safety Verdict

Is RewardsWP – Loyalty Points & Referral Program for WooCommerce Safe to Use in 2026?

Generally Safe

Score 100/100

RewardsWP – Loyalty Points & Referral Program for WooCommerce has no known CVEs and is actively maintained. It's a solid choice for most WordPress installations.

No known CVEs Updated 1mo ago
Risk Assessment

The "rewardswp" v1.0.6 plugin exhibits a generally strong security posture with several positive indicators. The vast majority of SQL queries utilize prepared statements, and a high percentage of output is properly escaped, demonstrating good development practices. The presence of numerous nonce and capability checks further bolsters its defenses against common attacks. Additionally, the absence of any recorded CVEs suggests a history of stable and likely secure development.

Key Concerns

  • AJAX handler without authentication check
  • Taint flow with unsanitized path (High Severity)
  • Taint flow with unsanitized path (High Severity)
  • Taint flow with unsanitized path (High Severity)
  • Taint flow with unsanitized path (High Severity)
Vulnerabilities
None known

RewardsWP – Loyalty Points & Referral Program for WooCommerce Security Vulnerabilities

No known vulnerabilities — this is a good sign.
Code Analysis
Analyzed Mar 16, 2026

RewardsWP – Loyalty Points & Referral Program for WooCommerce Code Analysis

Dangerous Functions
0
Raw SQL Queries
6
119 prepared
Unescaped Output
119
3253 escaped
Nonce Checks
50
Capability Checks
38
File Operations
5
External Requests
6
Bundled Libraries
1

Bundled Libraries

Select2

SQL Query Safety

95% prepared125 total queries

Output Escaping

96% escaped3372 total outputs
Data Flows
15 unsanitized

Data Flow Analysis

15 flows15 with unsanitized paths
maybe_render_iframe_preview (src\Controllers\Admin\EmailsAdminController.php:175)
Source (user input) Sink (dangerous op) Sanitizer Transform Unsanitized Sanitized
Attack Surface
1 unprotected

RewardsWP – Loyalty Points & Referral Program for WooCommerce Attack Surface

Entry Points48
Unprotected1

AJAX Handlers 48

authwp_ajax_rewardswp_dismiss_checklistsrc\Controllers\Admin\DashboardAdminController.php:96
authwp_ajax_rewardswp_show_checklistsrc\Controllers\Admin\DashboardAdminController.php:97
authwp_ajax_rewardswp_mark_widget_exploredsrc\Controllers\Admin\DashboardAdminController.php:98
authwp_ajax_rewardswp_toggle_email_statussrc\Controllers\Admin\EmailsAdminController.php:158
authwp_ajax_rewardswp_send_test_emailsrc\Controllers\Admin\EmailsAdminController.php:159
authwp_ajax_rewardswp_save_email_settingssrc\Controllers\Admin\EmailsAdminController.php:160
authwp_ajax_rewardswp_save_individual_emailsrc\Controllers\Admin\EmailsAdminController.php:161
authwp_ajax_rewardswp_get_attachment_urlsrc\Controllers\Admin\EmailsAdminController.php:162
authwp_ajax_rewardswp_connect_licensesrc\Controllers\Admin\LicenseController.php:96
authwp_ajax_rewardswp_disconnect_licensesrc\Controllers\Admin\LicenseController.php:97
authwp_ajax_rewardswp_activate_pro_pluginsrc\Controllers\Admin\LicenseController.php:98
noprivwp_ajax_rewardswp_connect_processsrc\Controllers\Admin\LicenseController.php:99
authwp_ajax_rewardswp_adjust_member_pointssrc\Controllers\Admin\MembersAdminController.php:168
authwp_ajax_rewardswp_update_member_referral_codesrc\Controllers\Admin\MembersAdminController.php:171
authwp_ajax_rewardswp_update_member_detailssrc\Controllers\Admin\MembersAdminController.php:174
authwp_ajax_rewardswp_update_member_statussrc\Controllers\Admin\MembersAdminController.php:177
authwp_ajax_rewardswp_delete_member_from_detailsrc\Controllers\Admin\MembersAdminController.php:180
authwp_ajax_rewardswp_add_membersrc\Controllers\Admin\MembersAdminController.php:183
authwp_ajax_rewardswp_search_userssrc\Controllers\Admin\MembersAdminController.php:186
authwp_ajax_rewardswp_dismiss_notificationsrc\Controllers\Admin\NotificationsAdminController.php:52
authwp_ajax_rewardswp_dismiss_all_notificationssrc\Controllers\Admin\NotificationsAdminController.php:53
authwp_ajax_rewardswp_save_settingssrc\Controllers\Admin\SettingsAdminController.php:106
authwp_ajax_rewardswp_get_reward_countsrc\Controllers\Admin\SettingsAdminController.php:107
authwp_ajax_rewardswp_download_csv_templatesrc\Controllers\Admin\ToolsAdminController.php:151
authwp_ajax_rewardswp_upload_csv_filesrc\Controllers\Admin\ToolsAdminController.php:152
authwp_ajax_rewardswp_load_csv_for_mappingsrc\Controllers\Admin\ToolsAdminController.php:153
authwp_ajax_rewardswp_validate_column_mappingssrc\Controllers\Admin\ToolsAdminController.php:154
authwp_ajax_rewardswp_process_csv_batchsrc\Controllers\Admin\ToolsAdminController.php:155
authwp_ajax_rewardswp_download_error_reportsrc\Controllers\Admin\ToolsAdminController.php:156
authwp_ajax_rewardswp_search_available_memberssrc\Controllers\Admin\UsersAdminController.php:119
authwp_ajax_rewardswp_create_membersrc\Controllers\AdvocateController.php:235
noprivwp_ajax_rewardswp_create_membersrc\Controllers\AdvocateController.php:236
noprivwp_ajax_rewardswp_login_usersrc\Controllers\AdvocateController.php:239
authwp_ajax_rewardswp_refresh_rewardssrc\Controllers\AdvocateController.php:242
authwp_ajax_rewardswp_clear_welcome_flowsrc\Controllers\AdvocateController.php:245
noprivwp_ajax_rewardswp_clear_welcome_flowsrc\Controllers\AdvocateController.php:246
authwp_ajax_rewardswp_get_member_activitysrc\Controllers\AdvocateController.php:249
noprivwp_ajax_rewardswp_get_member_activitysrc\Controllers\AdvocateController.php:250
noprivwp_ajax_rewardswp_apply_coupon_to_cartsrc\Controllers\ClaimController.php:144
authwp_ajax_rewardswp_apply_coupon_to_cartsrc\Controllers\ClaimController.php:145
noprivwp_ajax_rewardswp_claim_rewardsrc\Controllers\ClaimController.php:156
authwp_ajax_rewardswp_claim_rewardsrc\Controllers\ClaimController.php:157
authwp_ajax_rewardswp_track_eventsrc\Controllers\EventsController.php:54
noprivwp_ajax_rewardswp_track_eventsrc\Controllers\EventsController.php:55
authwp_ajax_rewardswp_resend_order_verificationsrc\Controllers\OrderLinkingVerificationController.php:134
authwp_ajax_rewardswp_redeem_points_for_couponsrc\Controllers\PointsController.php:112
noprivwp_ajax_rewardswp_track_visitsrc\Controllers\TrackingController.php:94
authwp_ajax_rewardswp_track_visitsrc\Controllers\TrackingController.php:95
WordPress Hooks 153
actionactivate_rewardswp/rewardswp.phprewardswp.php:85
actionadmin_initrewardswp.php:125
actionadmin_noticesrewardswp.php:183
actionnetwork_admin_noticesrewardswp.php:184
filterphpmailer_initsrc\Abstracts\AbstractEmailNotification.php:114
filterwp_mail_fromsrc\Abstracts\AbstractEmailNotification.php:115
filterwp_mail_from_namesrc\Abstracts\AbstractEmailNotification.php:116
actioninitsrc\AwesomeMotiveRewardsWP.php:169
actioninitsrc\AwesomeMotiveRewardsWP.php:172
actioninitsrc\AwesomeMotiveRewardsWP.php:175
actionadmin_enqueue_scriptssrc\Controllers\Admin\DashboardAdminController.php:95
actionadmin_menusrc\Controllers\Admin\EmailsAdminController.php:151
actionadmin_enqueue_scriptssrc\Controllers\Admin\EmailsAdminController.php:152
actionadmin_initsrc\Controllers\Admin\EmailsAdminController.php:155
filterrewardswp_email_view_argssrc\Controllers\Admin\EmailsAdminController.php:615
filterrewardswp_email_banner_datasrc\Controllers\Admin\EmailsAdminController.php:626
filterrewardswp_email_banner_datasrc\Controllers\Admin\EmailsAdminController.php:633
actionadmin_enqueue_scriptssrc\Controllers\Admin\MainAdminController.php:244
actionadmin_print_scriptssrc\Controllers\Admin\MainAdminController.php:245
actionadmin_headsrc\Controllers\Admin\MainAdminController.php:246
actionin_admin_headersrc\Controllers\Admin\MainAdminController.php:247
actionadmin_footersrc\Controllers\Admin\MainAdminController.php:248
actionadmin_menusrc\Controllers\Admin\MainAdminController.php:249
actionadmin_menusrc\Controllers\Admin\MainAdminController.php:250
actionadmin_initsrc\Controllers\Admin\MainAdminController.php:251
actionadmin_menusrc\Controllers\Admin\MainAdminController.php:252
actionadmin_print_footer_scriptssrc\Controllers\Admin\MainAdminController.php:253
actionadmin_enqueue_scriptssrc\Controllers\Admin\MainAdminController.php:254
actioncurrent_screensrc\Controllers\Admin\MainAdminController.php:261
filteradmin_footer_textsrc\Controllers\Admin\MainAdminController.php:263
filterrewardswp_current_member_overridesrc\Controllers\Admin\MainAdminController.php:726
filterscreen_options_show_screensrc\Controllers\Admin\MainAdminController.php:925
actionadmin_menusrc\Controllers\Admin\MembersAdminController.php:149
actionadmin_headsrc\Controllers\Admin\MembersAdminController.php:150
filterset-screen-optionsrc\Controllers\Admin\MembersAdminController.php:151
actionadmin_initsrc\Controllers\Admin\MembersAdminController.php:158
actionadmin_action_rewardswp_process_member_deletionsrc\Controllers\Admin\MembersAdminController.php:162
actionadmin_action_rewardswp_process_member_bulk_excludesrc\Controllers\Admin\MembersAdminController.php:165
actionadmin_menusrc\Controllers\Admin\PointsAdminController.php:79
actionadmin_headsrc\Controllers\Admin\PointsAdminController.php:80
filterset-screen-optionsrc\Controllers\Admin\PointsAdminController.php:81
actionadmin_menusrc\Controllers\Admin\ReferralsAdminController.php:91
actionadmin_headsrc\Controllers\Admin\ReferralsAdminController.php:92
filterset-screen-optionsrc\Controllers\Admin\ReferralsAdminController.php:93
actionadmin_menusrc\Controllers\Admin\ReportsAdminController.php:76
actionadmin_enqueue_scriptssrc\Controllers\Admin\ReportsAdminController.php:78
actionadmin_menusrc\Controllers\Admin\RewardsAdminController.php:79
actionadmin_headsrc\Controllers\Admin\RewardsAdminController.php:80
filterset-screen-optionsrc\Controllers\Admin\RewardsAdminController.php:81
actionadmin_menusrc\Controllers\Admin\SettingsAdminController.php:104
actionadmin_initsrc\Controllers\Admin\SettingsAdminController.php:105
actionadmin_enqueue_scriptssrc\Controllers\Admin\SettingsAdminController.php:108
actionadmin_print_stylessrc\Controllers\Admin\SettingsAdminController.php:109
actionadmin_initsrc\Controllers\Admin\SetupAdminController.php:88
actionadmin_menusrc\Controllers\Admin\ToolsAdminController.php:148
actionuser_new_formsrc\Controllers\Admin\UsersAdminController.php:102
actionshow_user_profilesrc\Controllers\Admin\UsersAdminController.php:105
actionedit_user_profilesrc\Controllers\Admin\UsersAdminController.php:106
actionuser_registersrc\Controllers\Admin\UsersAdminController.php:109
actionpersonal_options_updatesrc\Controllers\Admin\UsersAdminController.php:112
actionedit_user_profile_updatesrc\Controllers\Admin\UsersAdminController.php:113
actionadmin_enqueue_scriptssrc\Controllers\Admin\UsersAdminController.php:116
actionadmin_noticessrc\Controllers\Admin\UsersAdminController.php:343
actionadmin_noticessrc\Controllers\Admin\UsersAdminController.php:379
actionadmin_noticessrc\Controllers\Admin\UsersAdminController.php:390
actionuser_registersrc\Controllers\AdvocateController.php:231
actionwp_loginsrc\Controllers\AdvocateController.php:232
actiontemplate_redirectsrc\Controllers\AdvocateController.php:257
actionwp_footersrc\Controllers\AdvocateController.php:285
actionwp_enqueue_scriptssrc\Controllers\AdvocateController.php:286
actionrest_api_initsrc\Controllers\ApiController.php:48
actiontemplate_redirectsrc\Controllers\MainController.php:132
actionwp_enqueue_scriptssrc\Controllers\MainController.php:165
actionwp_enqueue_scriptssrc\Controllers\MainController.php:166
actioninitsrc\Controllers\OrderLinkingVerificationController.php:118
filterquery_varssrc\Controllers\OrderLinkingVerificationController.php:122
actiontemplate_redirectsrc\Controllers\OrderLinkingVerificationController.php:125
actionuser_registersrc\Controllers\OrderLinkingVerificationController.php:128
actionwoocommerce_created_customersrc\Controllers\OrderLinkingVerificationController.php:131
actionuser_registersrc\Controllers\PointsController.php:108
actionrewardswp_award_points_on_signupsrc\Controllers\PointsController.php:109
actionrewardswp_task_update_expired_rewardssrc\Controllers\TaskSchedulerController.php:64
actionrewardswp_task_send_emailsrc\Controllers\TaskSchedulerController.php:65
actionrewardswp_task_auto_enroll_customerssrc\Controllers\TaskSchedulerController.php:66
actionrewardswp_task_sync_notificationssrc\Controllers\TaskSchedulerController.php:67
actioninitsrc\Controllers\TaskSchedulerController.php:70
actionwp_enqueue_scriptssrc\Controllers\TrackingController.php:102
actionset_logged_in_cookiesrc\Helpers\UserHelper.php:139
actionwp_enqueue_scriptssrc\Integrations\EasyDigitalDownloadsIntegration.php:233
actionedd_payment_receipt_aftersrc\Integrations\EasyDigitalDownloadsIntegration.php:234
actionedd_complete_purchasesrc\Integrations\EasyDigitalDownloadsIntegration.php:235
actionedd_complete_purchasesrc\Integrations\EasyDigitalDownloadsIntegration.php:236
actionedd_complete_purchasesrc\Integrations\EasyDigitalDownloadsIntegration.php:237
actiontemplate_redirectsrc\Integrations\EasyDigitalDownloadsIntegration.php:238
actionedd_customer_updatedsrc\Integrations\EasyDigitalDownloadsIntegration.php:239
actionedd_insert_paymentsrc\Integrations\EasyDigitalDownloadsIntegration.php:240
actionedd_complete_purchasesrc\Integrations\EasyDigitalDownloadsIntegration.php:241
actionedd_complete_purchasesrc\Integrations\EasyDigitalDownloadsIntegration.php:242
actionedd_after_download_contentsrc\Integrations\EasyDigitalDownloadsIntegration.php:243
actionedd_approve_reviewsrc\Integrations\EasyDigitalDownloadsIntegration.php:247
actiontransition_comment_statussrc\Integrations\EasyDigitalDownloadsIntegration.php:251
actioncomment_postsrc\Integrations\EasyDigitalDownloadsIntegration.php:252
actionedd_refund_ordersrc\Integrations\EasyDigitalDownloadsIntegration.php:256
filterrewardswp_is_rewards_widget_visiblesrc\Integrations\EasyDigitalDownloadsIntegration.php:841
filterrewardswp_should_load_main_assetssrc\Integrations\EasyDigitalDownloadsIntegration.php:842
actionwp_enqueue_scriptssrc\Integrations\WooCommerceIntegration.php:171
actionwoocommerce_order_details_after_order_tablesrc\Integrations\WooCommerceIntegration.php:172
actionwoocommerce_checkout_update_order_metasrc\Integrations\WooCommerceIntegration.php:175
actionwoocommerce_store_api_checkout_order_processedsrc\Integrations\WooCommerceIntegration.php:179
actionwoocommerce_blocks_checkout_order_processedsrc\Integrations\WooCommerceIntegration.php:181
actionwoocommerce_order_status_completedsrc\Integrations\WooCommerceIntegration.php:185
actionwoocommerce_order_status_processingsrc\Integrations\WooCommerceIntegration.php:186
actionwoocommerce_new_ordersrc\Integrations\WooCommerceIntegration.php:188
actionwoocommerce_checkout_order_createdsrc\Integrations\WooCommerceIntegration.php:189
actionwoocommerce_new_ordersrc\Integrations\WooCommerceIntegration.php:190
actionwoocommerce_checkout_order_createdsrc\Integrations\WooCommerceIntegration.php:191
actionwoocommerce_order_status_completedsrc\Integrations\WooCommerceIntegration.php:192
actionwoocommerce_order_status_processingsrc\Integrations\WooCommerceIntegration.php:193
actionwoocommerce_order_status_completedsrc\Integrations\WooCommerceIntegration.php:194
actionwoocommerce_order_status_processingsrc\Integrations\WooCommerceIntegration.php:195
actionwoocommerce_order_status_on-holdsrc\Integrations\WooCommerceIntegration.php:196
actionwoocommerce_order_status_on-holdsrc\Integrations\WooCommerceIntegration.php:197
actiontemplate_redirectsrc\Integrations\WooCommerceIntegration.php:198
actionwoocommerce_customer_meta_updatedsrc\Integrations\WooCommerceIntegration.php:199
actionwoocommerce_new_ordersrc\Integrations\WooCommerceIntegration.php:200
actionwoocommerce_checkout_order_createdsrc\Integrations\WooCommerceIntegration.php:201
actionprofile_updatesrc\Integrations\WooCommerceIntegration.php:202
actionwoocommerce_order_status_completedsrc\Integrations\WooCommerceIntegration.php:203
actionwoocommerce_order_status_processingsrc\Integrations\WooCommerceIntegration.php:204
actionwoocommerce_payment_completesrc\Integrations\WooCommerceIntegration.php:205
actionwoocommerce_order_status_completedsrc\Integrations\WooCommerceIntegration.php:206
actionwoocommerce_order_status_processingsrc\Integrations\WooCommerceIntegration.php:207
actionwoocommerce_payment_completesrc\Integrations\WooCommerceIntegration.php:208
actionwoocommerce_single_product_summarysrc\Integrations\WooCommerceIntegration.php:209
actiontransition_comment_statussrc\Integrations\WooCommerceIntegration.php:210
actioncomment_postsrc\Integrations\WooCommerceIntegration.php:211
actionwoocommerce_order_status_completed_to_refundedsrc\Integrations\WooCommerceIntegration.php:214
actionwoocommerce_order_status_processing_to_refundedsrc\Integrations\WooCommerceIntegration.php:215
actionwoocommerce_order_status_pending_to_refundedsrc\Integrations\WooCommerceIntegration.php:216
actionwoocommerce_order_status_on-hold_to_refundedsrc\Integrations\WooCommerceIntegration.php:217
actionwoocommerce_order_refundedsrc\Integrations\WooCommerceIntegration.php:220
filterrewardswp_is_rewards_widget_visiblesrc\Integrations\WooCommerceIntegration.php:1051
filterrewardswp_should_load_main_assetssrc\Integrations\WooCommerceIntegration.php:1052
actionshutdownsrc\Models\Point.php:352
actionshutdownsrc\Models\Referral.php:333
actionwp_enqueue_scriptssrc\Services\AssetsService.php:110
actionadmin_enqueue_scriptssrc\Services\AssetsService.php:111
actionadmin_enqueue_scriptssrc\Services\AssetsService.php:112
actionadmin_enqueue_scriptssrc\Services\AssetsService.php:113
actionadmin_enqueue_scriptssrc\Services\ThemeCSSRemoverService.php:36
actionadmin_print_stylessrc\Services\ThemeCSSRemoverService.php:37
actionadmin_headsrc\Services\ThemeCSSRemoverService.php:38
filterstyle_loader_tagsrc\Services\ThemeCSSRemoverService.php:41
Maintenance & Trust

RewardsWP – Loyalty Points & Referral Program for WooCommerce Maintenance & Trust

Maintenance Signals

WordPress version tested6.9.4
Last updatedMar 2, 2026
PHP min version7.4
Downloads931

Community Trust

Rating100/100
Number of ratings1
Active installs90
Developer Profile

RewardsWP – Loyalty Points & Referral Program for WooCommerce Developer Profile

Andrew Munro / AffiliateWP

17 plugins · 3K total installs

71
trust score
Avg Security Score
88/100
Avg Patch Time
3200 days
View full developer profile
Detection Fingerprints

How We Detect RewardsWP – Loyalty Points & Referral Program for WooCommerce

Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.

Asset Fingerprints

Asset Paths
/wp-content/plugins/rewardswp/assets/css/rewardswp-admin-bar.css/wp-content/plugins/rewardswp/assets/css/rewardswp-admin.css/wp-content/plugins/rewardswp/assets/css/rewardswp-frontend.css/wp-content/plugins/rewardswp/assets/js/admin/rewardswp-admin-bar.js/wp-content/plugins/rewardswp/assets/js/admin/rewardswp-admin.js/wp-content/plugins/rewardswp/assets/js/admin/rewardswp-user-profile.js/wp-content/plugins/rewardswp/assets/js/frontend/rewardswp-frontend.js
Script Paths
/wp-content/plugins/rewardswp/assets/js/admin/rewardswp-admin-bar.js/wp-content/plugins/rewardswp/assets/js/admin/rewardswp-admin.js/wp-content/plugins/rewardswp/assets/js/admin/rewardswp-user-profile.js/wp-content/plugins/rewardswp/assets/js/frontend/rewardswp-frontend.js
Version Parameters
rewardswp/assets/css/rewardswp-admin-bar.css?ver=rewardswp/assets/css/rewardswp-admin.css?ver=rewardswp/assets/css/rewardswp-frontend.css?ver=rewardswp/assets/js/admin/rewardswp-admin-bar.js?ver=rewardswp/assets/js/admin/rewardswp-admin.js?ver=rewardswp/assets/js/admin/rewardswp-user-profile.js?ver=rewardswp/assets/js/frontend/rewardswp-frontend.js?ver=

HTML / DOM Fingerprints

CSS Classes
rewardswp-noticerewardswp-license-noticerewardswp-user-profile-section
HTML Comments
<!-- This file is intentionally left blank -->
Data Attributes
data-rewardswp-user-iddata-rewardswp-point-balancedata-rewardswp-referral-countdata-rewardswp-referral-iddata-rewardswp-referral-codedata-rewardswp-redeem-url+1 more
JS Globals
rewardswp_localizerewardswp_admin_paramsrewardswp_frontend_params
REST Endpoints
/wp-json/rewardswp/v1/points/wp-json/rewardswp/v1/referrals
Shortcode Output
[rewardswp_referral_code][rewardswp_referral_link][rewardswp_points][rewardswp_balance]
FAQ

Frequently Asked Questions about RewardsWP – Loyalty Points & Referral Program for WooCommerce