Description
WordPress Plugin YITH WooCommerce Points and Rewards is prone to a security bypass vulnerability. Exploiting this issue may allow attackers to perform otherwise restricted actions and subsequently modify plugin options. WordPress Plugin YITH WooCommerce Points and Rewards version 1.3.4 is vulnerable; prior versions may also be affected.
Remediation
Update to plugin version 1.3.6 or latest
References
https://blog.nintechnet.com/authenticated-settings-change-vulnerability-in-yit-plugin-framework/
https://plugins.svn.wordpress.org/yith-woocommerce-points-and-rewards/trunk/README.txt
Related Vulnerabilities
WordPress Plugin FormGet Contact Form Cross-Site Scripting (5.3)
WordPress Plugin Listing, Classified Ads & Business Directory-uListing Arbitrary File Upload (1.2.1)
WordPress Plugin WP Statistics SQL Injection (12.6.6.1)
WordPress Plugin Gallery PhotoBlocks Unspecified Vulnerability (1.1.32)
SharePoint Improper Input Validation Vulnerability (CVE-2009-3830)