{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-40786", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-04-15T09:20:42.117Z", "datePublished": "2026-04-15T10:21:36.068Z", "dateUpdated": "2026-04-16T14:20:54.766Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "woorewards", "product": "MyRewards", "vendor": "Long Watch Studio", "versions": [{"changes": [{"at": "5.7.4", "status": "unaffected"}], "lessThanOrEqual": "5.7.3", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Muhan Luo | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-15T12:20:45.571Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in Long Watch Studio MyRewards woorewards allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects MyRewards: from n/a through <= 5.7.3.</p>"}], "value": "Missing Authorization vulnerability in Long Watch Studio MyRewards woorewards allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MyRewards: from n/a through <= 5.7.3."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-15T10:21:36.068Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/woorewards/vulnerability/wordpress-myrewards-plugin-5-7-3-broken-access-control-vulnerability?_s_id=cve"}], "title": "WordPress MyRewards plugin <= 5.7.3 - Broken Access Control vulnerability"}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-04-16T14:19:48.305061Z", "id": "CVE-2026-40786", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-16T14:20:54.766Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-40786", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-04-15T09:20:42.117Z", "datePublished": "2026-04-15T10:21:36.068Z", "dateUpdated": "2026-04-16T14:20:54.766Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "woorewards", "product": "MyRewards", "vendor": "Long Watch Studio", "versions": [{"changes": [{"at": "5.7.4", "status": "unaffected"}], "lessThanOrEqual": "5.7.3", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Muhan Luo | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-15T12:20:45.571Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in Long Watch Studio MyRewards woorewards allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects MyRewards: from n/a through <= 5.7.3.</p>"}], "value": "Missing Authorization vulnerability in Long Watch Studio MyRewards woorewards allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MyRewards: from n/a through <= 5.7.3."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-15T10:21:36.068Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/woorewards/vulnerability/wordpress-myrewards-plugin-5-7-3-broken-access-control-vulnerability?_s_id=cve"}], "title": "WordPress MyRewards plugin <= 5.7.3 - Broken Access Control vulnerability"}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-40786", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-16T14:19:48.305061Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-16T14:18:20.373Z"}}]}}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Long Watch Studio MyRewards woorewards allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MyRewards: from n/a through <= 5.7.3."}], "id": "CVE-2026-40786", "lastModified": "2026-04-16T15:17:40.500", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2026-04-15T11:16:37.153", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/woorewards/vulnerability/wordpress-myrewards-plugin-5-7-3-broken-access-control-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,5.7.3]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.7.4,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "MyRewards", "source": "cna", "vendor": "Long Watch Studio"}, "product": "myrewards", "vendor": "long_watch_studio"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-17T07:56:27.547898+00:00", "value": {"mitigation_remediation": ["Update the MyRewards plugin to the latest release (>=5.7.4) as soon as a vendor patch is available.", "If an update is not immediately possible, restrict access to the plugin\u2019s administrative URLs by adding a capability check in the plugin code or using a .htaccess rule that allows only users with the \"manage_options\" capability to reach those pages.", "Monitor the site for suspicious activity and ensure that the plugin cannot be accessed by anonymous or non-admin users; consider disabling the plugin entirely if it is not critical."], "summary": {"action": "Patch immediately", "impact": "Privilege Escalation via Broken Access Control"}, "threat_synthesis": {"affected_systems": "The affected product is the WordPress plugin MyRewards from Long Watch Studio (also known as woorewards), with all releases through version 5.7.3 vulnerable. Any WordPress installation that has this plugin installed and uses one of those versions is at risk, regardless of the WordPress core version.", "description_and_impact": "The vulnerability is a missing authorization check in the Long Watch Studio MyRewards plugin that allows an attacker to bypass intended access controls. This flaw can enable unauthorized users to perform privileged actions through the plugin\u2019s interface or web endpoints, effectively escalating privileges within the WordPress site. The weakness falls under the privilege escalation category.", "risk_and_exploitability": "The CVSS score is 4.3, indicating a moderate impact. The EPSS score is <1%, showing a low exploitation probability, and the issue is not listed in CISA\u2019s KEV catalog. However, because the flaw is an access control bypass, it can be leveraged by anyone who can access the plugin\u2019s web interface, making the potential impact significant if the site is publicly reachable or if an attacker can obtain basic user credentials. The most likely attack vector is through crafted HTTP requests to the plugin\u2019s administrative endpoints, requiring only web access to the vulnerable WordPress instance."}}}}, "created": "2026-04-15T13:38:28.755462+00:00", "updated": "2026-04-17T08:00:11.110831+00:00", "vendors": ["long_watch_studio", "long_watch_studio$PRODUCT$myrewards", "wordpress", "wordpress$PRODUCT$wordpress"]}