CVE-2026-7534

Summary

The SUMO Reward Points plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REST API endpoint /wp-json/wc-srp/v1/earning in versions up to, and including, 32.7.0. This is due to the user_has_cap filter in the SRP_REST_Earning_Controller class unconditionally granting the custom rs_earning_read capability to all users — including unauthenticated visitors — combined with missing sanitization of the reason parameter in the create_items() function and missing output escaping in the column_default() method of SRP_Master_Log. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into the reward points log that will execute whenever an administrator accesses the Master Log or User Reward Points admin pages.

Affected Software

VendorProductVersion RangeStatus
FantasticPluginsSUMO Reward Points for WooCommerce0 <= 32.7.0affected

Weaknesses

  • CWE-79: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: partial

References