plugin
8 known security issues reported for the Points And Rewards For Woocommerce WordPress plugin. Most recent disclosed Aug 5, 2026.
Running Points And Rewards For Woocommerce on your site? Check whether your installed version is affected.
Scan your site freeThe Points and Rewards for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to 2.10.1 due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to perform an unauthorized action.
The Points and Rewards for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.10.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level acces...
[en] Missing Authorization vulnerability in WP Swings Points and Rewards for WooCommerce points-and-rewards-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Points and Rewards for WooCommerce: from n/a through <= 2.9.5.
The Points and Rewards for WooCommerce – Create Loyalty Programs, Reward Customer Purchases, User Badges, Gamification plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.9.5. This makes it possible for authenticated attackers...
[en] Missing Authorization vulnerability in WP Swings Points and Rewards for WooCommerce.This issue affects Points and Rewards for WooCommerce: from n/a through 1.5.0.
[en] Missing Authorization vulnerability in WP Swings Points and Rewards for WooCommerce.This issue affects Points and Rewards for WooCommerce: from n/a through 1.5.0.
The Points and Rewards for WooCommerce plugin for WordPress is vulnerable to missing authorization due to a missing capability check on the 'wps_wpr_points_update' function in versions up to, and including, 1.5.0. This makes it possible for unauthenticated attackers to update reward points.
The Points and Rewards for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.0. This is due to a missing nonce check on the wps_wpr_points_update function. This makes it possible for unauthenticated attackers to change plugin settings via a forged request...
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free