bLoyal: Loyalty & Promotions by bLoyal

bLoyal: Loyalty & Promotions by bLoyal has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of October 2026. Their average CVSS score is 8.8, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 1 high.

The most common weakness is Improper Privilege Management, behind 1 of the records (100%).

The one issue recorded for bLoyal: Loyalty & Promotions by bLoyal has a vendor fix available, so running the current release closes it.

All of these findings were reported by CHOIGYEONGMIN. bLoyal: Loyalty & Promotions by bLoyal is installed on roughly 20 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSHigh
8.8/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all bLoyal: Loyalty & Promotions by bLoyal vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2026-15001

bLoyal: Loyalty & Promotions by bLoyal <= 3.1.611.78 - Authenticated (Subscriber+) Privilege Escalation via Unprotected AJAX API URL Settings

Read the full analysis

Vulnerability Records

1 records
bLoyal: Loyalty & Promotions by bLoyal banner
Latestv3.1.611.90

bLoyal: Loyalty & Promotions by bLoyal

bLoyal

Author

bLoyal

0.0(0)
0/100
Last Updated
2026-08-21 (2mo ago)
Active Installs
20+
Downloads
2,869
Requires WP
5.6+
Requires PHP
7.4+
Tested up to
WP 7.1.3
Created
2023-06-23 (3y ago)

Introduction bLoyal enables WooCommerce users to grow their loyal customer base and engage with their customers across all devices and sales channels. The bLoyal App enables you to have a single customer master record across your WooCommerce store and physical store(s) and run a consistent loyalty program, promotions, and engagement across all your sales channels. bLoyal also enables you to sell and accept gift/egift cards and customer loyalty tender in WooCommerce and in your physical store. For more information, please go to bLoyal.com Major features in bLoyal include: Powerful promotions and loyalty programs Single Master Customer Record. Automated Subscriptions. Referral Programs Real-Time Lifecycle Engagement. Click-and-Collect- Sell online and pick up in store. REQUEST A DEMO For complete list of features and details, please visit More Information To learn how to install the plugin, navigate to the Installation tab. For detailed guidance on the installation and setup of the plugin, refer to the plugin documentation. Terms and Conditions PS: Once integrated, you’ll have access to an unrivaled set of loyalty program management tools that will help achieve your business goals; Support Get quick answers to your questions with support resources, documentation, and step-by-step video walk-throughs for common bLoyal’s frequently asked questions License Changes Fixed duplicate coupon error messages by checking flag status before showing “already applied” error Only show error if coupon is fully applied (flag=true), suppress notice for pending validation (flag=false) Added proper escaping with esc_html() for security 3.1.611.59 Release Date – 22 Dec 2025 Fix: Coupon double application issue (Kanna Collective) Changes Fixed coupon timing issue by setting flag=true immediately after successful API call Added cart calculation trigger to ensure discount applies immediately Enhanced error suppression for bLoyal coupons to prevent WooCommerce validation errors Fixed duplicate check logic to only show error when coupon is fully applied Removed HTML output from filter hook (WordPress best practice) This fixes the issue where customers had to apply coupons twice and addresses the UI/backend mismatch where backend succeeded but frontend showed errors. 3.1.611.60 Release Date – 8 Jan 2026 Fix: eGift card package/shipping errors when guest creates account at checkout. Proactive cart_uid preservation to order metadata during checkout, fallback retrieval mechanism for cart_uid when session is lost, enhanced postmeta table management for backoffice connector compatibility, improved SQL security with prepared statements. 3.1.611.61 Release Date – 12 Jan 2026 Fix cart UID persistence for WooCommerce orders. Ensures cart_uid is saved to the database even when CommitCart API call fails, preventing loss of loyalty data, shipping services, and e-gift card information. 3.1.611.62 Release Date – 16 Jan 2026 Enhanced cart UID persistence with multi-point fallback system. Implements early cart_uid capture before CommitCart in multiple checkout hooks. Adds fallback retrieval from bloyal_cart_data session when plugin is deactivated mid-checkout, ensuring cart_uid is always persisted even when CommitCart fails or plugin is disconnected.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C