CVE-2026-40786

CVE-2026-40786 is a missing authorization vulnerability affecting Long Watch Studio's MyRewards plugin for WooCommerce, impacting versions 5.7.3 and earlier. The flaw stems from incorrectly configured access control security levels that could allow unauthorized users to bypass intended restrictions. The vulnerability carries a CVSS severity score of 4.3 (Medium) with a network-based attack vector requiring low complexity and valid user credentials. Exploitation could result in limited confidentiality impact through unauthorized information disclosure, though integrity and availability are not affected. The attack requires network access and authenticated privileges, which moderates the overall risk profile. There is no evidence of active exploitation in the wild, with the vulnerability not appearing on the CISA Known Exploited Vulnerabilities catalog. The EPSS score of 0.00028 indicates very low probability of exploitation, and the vulnerability remains on the inactive Hot List. Community attention appears minimal, suggesting this represents a lower-priority patching requirement for affected organizations.