What is the CVSS score of CVE-2026-7534?

CVE-2026-7534 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of SUMO Reward Points are affected by CVE-2026-7534?

SUMO Reward Points for WooCommerce (versions ≤32.7.0) contains an unauthenticated stored cross-site scripting vulnerability allowing attackers to inject malicious code executed in administrator…

How to fix or mitigate CVE-2026-7534?

Within 24 hours: audit WordPress instances for SUMO Reward Points v32.7.0 or earlier and assess whether the rewards feature is business-critical. Within 7 days: disable the plugin if not essential, or implement Web Application Firewall rules blocking unauthenticated access to `/wp-json/wc-srp/v1/earning`, enforce multi-factor authentication for all administrator accounts, and deploy Content-Security-Policy headers to restrict inline script execution. Within 30 days: monitor SUMO plugin repository and security advisories for a patched version; develop an upgrade plan or evaluate alternative rewards solutions.

SUMO Reward Points CVE-2026-7534

EUVD-2026-47877 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-23 Wordfence

GHSA-j42q-gjcw-f29h

XSS WordPress Sumo Reward Points For Woocommerce

7.2

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Unauthenticated network injection (AV:N/AC:L/PR:N) but payload executes only when an admin views the log page (UI:R), running in admin context for a scope change (S:C) with limited C/I impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 06:16 vuln.today

CVE Published

Jul 23, 2026 - 05:35 cve.org

HIGH 7.2

DescriptionCVE.org

The SUMO Reward Points plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REST API endpoint /wp-json/wc-srp/v1/earning in versions up to, and including, 32.7.0. This is due to the user_has_cap filter in the SRP_REST_Earning_Controller class unconditionally granting the custom rs_earning_read capability to all users - including unauthenticated visitors - combined with missing sanitization of the reason parameter in the create_items() function and missing output escaping in the column_default() method of SRP_Master_Log. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into the reward points log that will execute whenever an administrator accesses the Master Log or User Reward Points admin pages.

AnalysisAI

Unauthenticated stored cross-site scripting in the SUMO Reward Points for WooCommerce WordPress plugin (versions up to and including 32.7.0) lets any anonymous visitor inject persistent JavaScript through the /wp-json/wc-srp/v1/earning REST endpoint. A broken user_has_cap filter hands the rs_earning_read capability to everyone, so an attacker can write an unsanitized reason value that later executes in an administrator's browser when the Master Log or User Reward Points pages are viewed. There is no public exploit identified at time of analysis and the plugin is not on CISA KEV, but the flaw is trivially reachable and Wordfence-confirmed.

Technical ContextAI

The affected software is a premium WooCommerce loyalty/rewards plugin (CPE cpe:2.3:a:fantasticplugins:sumo_reward_points_for_woocommerce) that exposes a custom WordPress REST API namespace (wc-srp/v1). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation) compounded by a broken access-control decision: the SRP_REST_Earning_Controller class registers a user_has_cap filter that unconditionally grants the custom rs_earning_read capability to every request context, including unauthenticated ones. WordPress capability filters are meant to conditionally elevate specific privileges; here it effectively removes authentication from the earning endpoint. The create_items() function then stores the reason parameter without sanitization, and SRP_Master_Log::column_default() renders that stored value in the admin list table without output escaping (e.g. esc_html), so the payload is persisted server-side and reflected into a privileged admin page - a classic stored/second-order XSS.

RemediationAI

No vendor-released patched version was identified in the provided data, so the exact fixed release cannot be cited (do not assume one beyond 32.7.0). Update to any release later than 32.7.0 once the vendor publishes it, and monitor the CodeCanyon item page and the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/366b5051-d042-4425-9aad-b77d93bcd485?source=cve) for the fixed build. As compensating controls until patched: block or restrict access to the /wp-json/wc-srp/v1/earning REST route at the web server or WAF layer (trade-off: may break legitimate earning API calls if the site relies on that endpoint), deploy a WAF rule to filter script/HTML payloads in the reason parameter, and consider disabling the SUMO Reward Points plugin if the rewards feature is non-essential (trade-off: loyalty program stops functioning). Administrators should avoid opening the Master Log and User Reward Points admin pages until remediated, since that view is what triggers payload execution.