# Gaining unlimited bonus points on websites with WooCommerce Points and Rewards

WooCommerce Points and Rewards credits points on 'processing' status, so Cash On Delivery orders grant spendable points before payment, enabling unlimited point farming.

- Payout: hidden
- Severity: high
- Program: Automattic
- Found by: kolyasapphire
- Disclosed: 2019-07-05
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/592803
- Library page: https://bugbountylibrary.com/r/h1%3A592803
- Tags: area:web domain:web impact:funds-loss kind:bounty platform:hackerone sev:high tech:php tech:wordpress technique:source-review vuln:accounting-error vuln:business-logic vuln:reward-distribution

**Target:** WooCommerce Points and Rewards plugin (class-wc-points-rewards-order.php)
**Root cause:** maybe_update_points awards points on woocommerce_order_status_processing, assuming processing means paid; Cash On Delivery sets orders to processing immediately on creation, so points are granted before any payment.
**Steps:**
1. Enable WooCommerce Points and Rewards and Cash On Delivery gateway.
2. Place an order using Cash On Delivery; status becomes 'processing' immediately.
3. maybe_update_points fires on woocommerce_order_status_processing and calls add_points_earned, crediting points for the order total.
4. Spend the credited points on a subsequent order (up to configured redemption limit), repeat to accumulate unlimited points.
**How found:** Noticed the plugin assumes 'processing' status implies a paid order, then checked which payment gateways set processing on order creation and found Cash On Delivery does so immediately.
**Exploitation:** Attacker repeatedly places COD orders to trigger processing status, earning points each time without paying, then redeems them on later orders up to the plugin's max redemption percentage.
**Insight:** When a plugin keys rewards/entitlements off order status, enumerate every payment gateway that can set that status without actual payment (COD, bank transfer, cheque) rather than trusting the status semantics.