CVE-2025-15260

MEDIUM

MyRewards for WooCommerce - Missing Authorization in Ajax Function

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2025-15260. PoCs published by d3kc4rt1.

AI-analyzed exploit summary This repository provides a detailed technical analysis of CVE-2025-15260, a Broken Access Control vulnerability in the MyRewards WooCommerce plugin, including root cause, exploit steps, and remediation. It includes a functional PoC but focuses on educational disclosure.

Description

The MyRewards – Loyalty Points and Rewards for WooCommerce plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 5.6.1. This is due to the plugin not properly verifying that a user is authorized to perform an action in the 'ajax' function. This makes it possible for authenticated attackers, with subscriber level access and above, to modify, add, or delete loyalty program earning rules, including manipulating point multipliers to arbitrary values.

Exploits (1)

nomisec WRITEUP

by d3kc4rt1 · poc

https://github.com/d3kc4rt1/CVE-2025-15260

View Code ZIP pw:eip

This repository provides a detailed technical analysis of CVE-2025-15260, a Broken Access Control vulnerability in the MyRewards WooCommerce plugin, including root cause, exploit steps, and remediation. It includes a functional PoC but focuses on educational disclosure.

Classification

Writeup 100%

Attack Type

Auth Bypass

Complexity

Moderate

Reliability

Reliable

Target: MyRewards – Loyalty Points and Rewards for WooCommerce <= 5.6.0

Auth required

Prerequisites: WooCommerce with MyRewards plugin <= 5.6.0 · Authenticated Subscriber-level account · Valid reward rule ID

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1078 - Valid Accounts

devstral-2 · analyzed Apr 10, 2026 Full analysis →

References (3)

Core 3

Core References

https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3458815%40woorewards&new=3458815%40woorewards&sfp_email=&sfph_mail=

Product

https://plugins.trac.wordpress.org/browser/woorewards/tags/5.6.0/assets/lws-adminpanel/include/internal/editlistcontroler.php#L76

Third Party Advisory

https://www.wordfence.com/threat-intel/vulnerabilities/id/2591f473-44ff-4319-8b17-b0f793a29d66?source=cve

Scores

CVSS v3 6.5

EPSS 0.0027

EPSS Percentile 19.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-862

Status published

Products (2)

lwsdevelopers/MyRewards < 5.6.1

lwsdevelopers/MyRewards – Loyalty Points and Rewards for WooCommerce – Reward orders, referrals, product reviews and more < 5.6.0

Published Feb 04, 2026

Tracked Since Feb 18, 2026