Executive brief
The SUMO Reward Points plugin for WordPress, which manages customer loyalty programs for WooCommerce stores, contains a security flaw that allows unauthorized visitors to inject malicious code into the website's administrative logs. This code is automatically triggered when a site administrator views the reward points or master log pages. An attacker could use this to hijack administrator sessions, redirect users to malicious sites, or perform unauthorized actions on the website.
Technical details
The SUMO Reward Points plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to an authorization bypass and insufficient input/output handling. The `user_has_cap` filter in the `SRP_REST_Earning_Controller` class incorrectly grants the `rs_earning_read` capability to unauthenticated users, allowing them to access the `/wp-json/wc-srp/v1/earning` REST API endpoint. Attackers can exploit this by submitting a request with a malicious payload in the `reason` parameter, which lacks sanitization in the `create_items()` function. Because the `column_default()` method in `SRP_Master_Log` fails to escape this data upon output, the injected script executes in the context of an administrator's browser when they view the Master Log or User Reward Points admin pages. This vulnerability affects all versions up to and including 32.7.0.
Affected products
- FantasticPlugins SUMO Reward Points for WooCommerce up to, and including, 32.7.0
Timeline
- 2026-07-23: disclosed: CVE published to NVD via Wordfence