CVE-2026-7534 in SUMO Reward Points Plugin
Summary
by MITRE • 07/23/2026
The SUMO Reward Points plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REST API endpoint `/wp-json/wc-srp/v1/earning` in versions up to, and including, 32.7.0. This is due to the `user_has_cap` filter in the `SRP_REST_Earning_Controller` class unconditionally granting the custom `rs_earning_read` capability to all users — including unauthenticated visitors — combined with missing sanitization of the `reason` parameter in the `create_items()` function and missing output escaping in the `column_default()` method of `SRP_Master_Log`. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into the reward points log that will execute whenever an administrator accesses the Master Log or User Reward Points admin pages.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/23/2026
The SUMO Reward Points plugin for WordPress presents a critical security vulnerability through an unauthenticated stored cross-site scripting flaw in its REST API endpoint. This vulnerability exists within version 32.7.0 and earlier releases, creating a significant risk for WordPress installations that utilize this plugin. The core issue stems from improper capability management where the `user_has_cap` filter in the `SRP_REST_Earning_Controller` class grants the custom `rs_earning_read` capability to all users without proper authentication checks. This fundamental flaw allows any visitor to the website to gain access rights that should be restricted to authenticated administrators, establishing a foothold for malicious activities.
The technical exploitation occurs through multiple interconnected weaknesses in the plugin's codebase. The `create_items()` function within the REST API controller fails to sanitize the `reason` parameter that users can submit through the `/wp-json/wc-srp/v1/earning` endpoint, creating an injection vector for malicious scripts. Additionally, the `column_default()` method in the `SRP_Master_Log` class lacks proper output escaping mechanisms, meaning that any data stored in the reward points log gets rendered without adequate HTML sanitization. This combination of insufficient input validation and output encoding creates a perfect storm where attacker-controlled scripts can be permanently stored in the plugin's database tables and subsequently executed whenever administrators view the reward points logs.
The operational impact of this vulnerability extends beyond simple script execution, representing a serious threat to WordPress administrator security and system integrity. When administrators access the Master Log or User Reward Points admin pages, their browsers execute the malicious scripts embedded in the stored data, potentially leading to session hijacking, credential theft, or further compromise of the WordPress installation. This vulnerability aligns with CWE-79 (Cross-Site Scripting) and follows ATT&CK technique T1566.001 (Phishing via Social Engineering) by enabling attackers to craft malicious payloads that appear legitimate within the administrative interface. The unauthenticated nature of the attack means that even websites with strong user authentication can be compromised through this vector, as the vulnerability exists at the plugin level rather than requiring valid user credentials.
Organizations affected by this vulnerability should immediately update to the latest version of the SUMO Reward Points plugin where this issue has been addressed through proper capability checks and input sanitization measures. The fix should implement proper authentication verification before granting access capabilities and ensure comprehensive sanitization of all user-provided data before storage. Additionally, administrators should conduct thorough security audits of their WordPress installations, monitoring for any suspicious activity in the reward points logs or related database entries. Security monitoring solutions should be configured to detect unusual patterns in REST API access attempts, particularly those targeting the vulnerable endpoint, as this vulnerability represents a classic example of how seemingly minor permission flaws can create significant attack surface expansion.