WordPress security by component
bloyal
bloyal (bloyal) is a WordPress plugin with 1 published CVE record in this archive. The latest tracked vulnerability was published Aug 15, 2026; the highest published CVSS base score is 8.8.
Plugin slug:
bloyalLatest vulnerability
CVE-2026-15001: bLoyal settings overwrite lets Subscribers authenticate as any user
bLoyal through 3.1.611.78 exposes save_bloyal_configuration_data and save_bloyal_accesskeyverification_data without nonce or capability checks. A Subscriber can replace the Loyalty Engine API URL and enable the custom-API flag, then invoke the public /cart REST route; bloyal_customer_auto_login() trusts Customer.ExternalId returned by the attacker endpoint and calls wp_set_auth_cookie() for that WordPress ID. This permits login as any account, including an administrator. The remaining request bodies and API response fields are not disclosed.
| Safe version |
|
||
|---|---|---|---|
| Aug 15, 2026 |
CVE-2026-15001
bLoyal settings overwrite lets Subscribers authenticate as any user
bLoyal through 3.1.611.78 exposes save_bloyal_configuration_data and save_bloyal_accesskeyverification_data without nonce or capability checks. A Subscriber can replace the Loyalty Engine API URL and enable the custom-API flag, then invoke the public /cart REST route; bloyal_customer_auto_login() trusts Customer.ExternalId returned by the attacker endpoint and calls wp_set_auth_cookie() for that WordPress ID. This permits login as any account, including an administrator. The remaining request bodies and API response fields are not disclosed.
|
See mitigation notes |
CVE8.8
NVDPending
|