WordPress security changelog
HIGH CVE-2026-15001 Deferred

bLoyal settings overwrite lets Subscribers authenticate as any user

bLoyal through 3.1.611.78 exposes save_bloyal_configuration_data and save_bloyal_accesskeyverification_data without nonce or capability checks. A Subscriber can replace the Loyalty Engine API URL and enable the custom-API flag, then invoke the public /cart REST route; bloyal_customer_auto_login() trusts Customer.ExternalId returned by the attacker endpoint and calls wp_set_auth_cookie() for that WordPress ID. This permits login as any account, including an administrator. The remaining request bodies and API response fields are not disclosed.

CVE / CNA score 8.8 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
bLoyal: Loyalty & Promotions by bLoyal
Plugin slug
bloyal
Affected
<= 3.1.611.78
Safe version
See mitigation notes
Published
Aug 15, 2026
Weakness
CWE-269 — Improper Privilege Management

This CVE was published Aug 15, 2026 and is one of 1 known issue for this plugin.

What to do

Update, patch or deactivate.

No fixed release is identified in the authoritative record. Update when a confirmed patch is available; until then, deactivate bLoyal auto-login when warranted and audit API settings, administrator logins, roles, and sessions.

No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The bLoyal: Loyalty & Promotions by bLoyal plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.611.78. This is due to the AJAX actions `save_bloyal_configuration_data` and `save_bloyal_accesskeyverification_data` being registered without any capability or nonce checks, and the `bloyal_customer_auto_login` function unconditionally trusting the `Customer.ExternalId` value returned by whichever API URL is stored in the plugin's options. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the plugin's bLoyal Loyalty Engine API URL (`bloyal_custom_loyaltyengine_api_url`) and the `is_bloyal_custom_api_url` flag via the unprotected AJAX actions, then trigger the unauthenticated `/cart` REST route to cause `bloyal_customer_auto_login` to fetch customer data from an attacker-controlled endpoint and call `wp_set_auth_cookie()` with an attacker-supplied `Customer.ExternalId`, thereby authenticating as any WordPress user including the site Administrator.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Primary and upstream sources