Loyalty & Promotions by BLoyal (3.1.611.78) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/loyalty--promotions-by-bloyal-3.1.611.78/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 15 Aug 2026 04:16:39 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgPrivilege Escalation in bLoyal: Loyalty & Promotions WordPress Pluginhttps://feed.craftedsignal.io/briefs/2026-08-bloyal-privesc/Sat, 15 Aug 2026 04:16:39 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-bloyal-privesc/The bLoyal: Loyalty & Promotions plugin for WordPress contains an unauthenticated configuration modification and privilege escalation vulnerability, CVE-2026-15001, allowing low-privileged users to assume administrator accounts.The bLoyal: Loyalty & Promotions plugin for WordPress (versions 3.1.611.78 and earlier) is susceptible to a critical privilege escalation vulnerability, tracked as CVE-2026-15001. The flaw stems from the insecure implementation of AJAX actions save_bloyal_configuration_data and save_bloyal_accesskeyverification_data, which lack necessary capability and nonce validation. Furthermore, the bloyal_customer_auto_login function blindly trusts the Customer.ExternalId returned by an API endpoint configurable within the plugin. An attacker with minimal Subscriber-level access can modify these plugin settings to point to an attacker-controlled API. By subsequently triggering the /cart REST route, the attacker forces the plugin to fetch a malicious user payload from their own server, leading to an unauthorized call to wp_set_auth_cookie() that elevates the attacker's session to that of any site user, including administrators.

Impact

Successful exploitation results in full site compromise by granting the attacker administrator-level access. As this vulnerability affects a plugin with e-commerce and loyalty functionality, targets include any WordPress site utilizing the affected versions for customer management and promotions.

Recommendation

  • Update the bLoyal: Loyalty & Promotions plugin to the latest version immediately to remediate CVE-2026-15001.
  • Audit WordPress site logs for unauthorized requests to the /wp-admin/admin-ajax.php endpoint containing save_bloyal_configuration_data or save_bloyal_accesskeyverification_data parameters originating from low-privileged user accounts.
  • Monitor site configuration changes for unexpected modifications to the bloyal_custom_loyaltyengine_api_url option in the WordPress database.
]]>highadvisory