CVE-2026-7534: WordPress SUMO Reward Points XSS Flaw

CVE-2026-7534 Overview

CVE-2026-7534 is an unauthenticated stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the SUMO Reward Points plugin for WordPress. The flaw affects all versions up to and including 32.7.0. It resides in the REST API endpoint /wp-json/wc-srp/v1/earning, which fails to restrict access and sanitize input. Unauthenticated attackers can inject arbitrary JavaScript into the reward points log. The payload executes when an administrator views the Master Log or User Reward Points admin pages, enabling session hijacking, privilege escalation, and administrative account takeover.

Critical Impact
Unauthenticated attackers can inject persistent JavaScript that executes in an administrator's browser session, potentially leading to full site compromise.

Affected Products

SUMO Reward Points plugin for WordPress (WooCommerce Reward System)
All plugin versions up to and including 32.7.0
WordPress installations exposing the /wp-json/wc-srp/v1/earning REST route

Discovery Timeline

2026-07-23 - CVE-2026-7534 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-7534

Vulnerability Analysis

The vulnerability chains three distinct implementation errors in the SUMO Reward Points plugin. First, the SRP_REST_Earning_Controller class hooks into WordPress's user_has_cap filter and unconditionally grants the custom rs_earning_read capability to every request, including unauthenticated visitors. This effectively removes access control from the REST endpoint. Second, the create_items() function accepts a reason parameter without applying sanitization routines such as wp_kses or sanitize_text_field. Third, the column_default() method of the SRP_Master_Log class renders stored log values in the WordPress admin without applying esc_html or equivalent output escaping. The combination produces a persistent XSS primitive that stores attacker payloads in the database and executes them in a privileged browser context.

Root Cause

The root cause is a broken authorization model layered with dual input and output handling failures. The user_has_cap filter is designed to conditionally grant capabilities based on request context. In this plugin, it is applied unconditionally, converting a privileged capability into a public one. Neither input sanitization at the storage boundary nor output escaping at the rendering boundary compensates for this authorization gap.

Attack Vector

An attacker sends an unauthenticated HTTP POST request to /wp-json/wc-srp/v1/earning with a crafted reason field containing JavaScript. The plugin stores the raw payload in the reward points log table. When an administrator later navigates to the Master Log or User Reward Points admin page, the unescaped payload is rendered inline, executing in the administrator's authenticated session. The attacker can then perform actions such as creating administrative users, injecting backdoors into theme files, or exfiltrating session cookies.

No verified proof-of-concept code has been published. See the Wordfence Vulnerability Report for technical details.

Detection Methods for CVE-2026-7534

Indicators of Compromise

Unauthenticated POST requests to /wp-json/wc-srp/v1/earning originating from unexpected IP addresses
Reward points log entries containing HTML tags, <script> fragments, onerror=, onload=, or javascript: strings in the reason field
Creation of new WordPress administrator accounts without a corresponding legitimate admin session
Unexpected modifications to theme files, plugins, or wp_options immediately after an admin views the Master Log

Detection Strategies

Review web server access logs for POST requests to the /wp-json/wc-srp/v1/earning endpoint
Query the reward points log database table for entries whose reason column contains angle brackets or event handler attributes
Correlate REST API request timestamps with subsequent administrative actions in the WordPress audit log
Deploy a Web Application Firewall (WAF) rule that inspects request bodies to the SUMO Reward Points endpoints for script markers

Monitoring Recommendations

Alert on any WordPress role or capability changes following an administrator visit to /wp-admin/admin.php?page=sumorewardpoints_master_log
Monitor outbound HTTP requests from administrator browsers for anomalous destinations that may indicate cookie exfiltration
Enable file integrity monitoring on the WordPress wp-content directory to identify post-exploitation backdoors

How to Mitigate CVE-2026-7534

Immediate Actions Required

Update the SUMO Reward Points plugin to a version later than 32.7.0 once the vendor publishes a patched release
If no patched version is available, deactivate and remove the plugin from production WordPress installations
Audit the reward points log table and purge any entries containing HTML or JavaScript payloads before administrators access the affected pages
Rotate WordPress administrator passwords and invalidate active sessions if the Master Log has been viewed during the exposure window

Patch Information

No fixed version is listed in the NVD entry at the time of publication. Refer to the Wordfence Vulnerability Report and the CodeCanyon plugin listing for vendor updates.

Workarounds

Block external access to the /wp-json/wc-srp/v1/earning REST route at the WAF or reverse proxy layer until a patch is applied
Use a WordPress security plugin to restrict REST API access to authenticated users
Instruct administrators to avoid opening the Master Log and User Reward Points admin pages until remediation is complete
Apply a Content Security Policy (CSP) header that blocks inline script execution in the WordPress admin

bash

# Example NGINX rule to block unauthenticated access to the vulnerable endpoint
location ~ ^/wp-json/wc-srp/v1/earning {
    deny all;
    return 403;
}