Access violation vulnerability in MyRewards – Loyalty Points and Rewards for WooCommerce – Reward orders, referrals, product reviews and more 5.6.0

The MyRewards plugin for WordPress allows users to earn loyalty points and rewards on WooCommerce. However, it has a security vulnerability in all versions up to 5.6.0. This means that the plugin does not properly check if a user has permission to do something in the ‘ajax’ function. As a result, attackers with subscriber level access or higher can change, add, or delete rules for earning loyalty points. They can even change the point multipliers to any value they want.