SUMO Reward Points CVE-2026-7534

Exploitation requires that the SUMO Reward Points for WooCommerce plugin (version ≤ 32.7.0) be installed and active, exposing the REST route /wp-json/wc-srp/v1/earning; the vulnerable user_has_cap filter grants rs_earning_read to unauthenticated requests by default, so no authentication, account, or non-default configuration is needed to inject the payload. The key LIMITING factor is that the injected script does not execute at injection time - it only fires when a logged-in administrator subsequently views the Master Log or User Reward Points admin page, so successful impact depends on privileged victim interaction rather than being fully automatic.

Signals are moderate and mostly consistent. The reporter (Wordfence) CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N (7.2, High) reflects unauthenticated network reachability, low complexity, and a scope change into the administrator's authenticated session. One nuance to verify: the vector marks UI:N, but as stored XSS the payload only fires when an administrator navigates to the Master Log or User Reward Points page, which is effectively passive/required victim interaction - I assess UI:R (CVSS 4.0 UI:P), which slightly lowers realistic urgency. Impact is rated Low/Low because XSS in the admin context can drive account takeover or settings changes rather than direct full compromise, though a successful admin-context script can escalate to plugin/user manipulation. No EPSS score was supplied, the CVE is not in CISA KEV (no active exploitation confirmed), and no public POC is referenced - so this is a genuine, easily reachable vulnerability but currently a patch-soon priority rather than an emergency drop-everything item. The gating factor that keeps it from being critical is dependence on an administrator viewing the poisoned log page.

An anonymous attacker sends a crafted POST to https://victim-store/wp-json/wc-srp/v1/earning with a reason field containing a JavaScript payload (e.g. an image onerror handler). The broken capability filter accepts the unauthenticated request and stores the payload; later, when a store administrator opens the Master Log page, the script executes in their authenticated session and can create a rogue admin, exfiltrate nonces, or alter reward balances. No public POC is referenced, but the endpoint and low complexity make exploitation straightforward for a knowledgeable attacker.