PT-2026-63572 · Fantasticplugins · Points/Rewards For Woocommerce

CVE-2026-7534 · Publicado 2026-07-23 · Atualizado 2026-07-23

Mitre

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

The SUMO Reward Points plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REST API endpoint /wp-json/wc-srp/v1/earning in versions up to, and including, 32.7.0. This is due to the user has cap filter in the SRP REST Earning Controller class unconditionally granting the custom rs earning read capability to all users — including unauthenticated visitors — combined with missing sanitization of the reason parameter in the create items() function and missing output escaping in the column default() method of SRP Master Log. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into the reward points log that will execute whenever an administrator accesses the Master Log or User Reward Points admin pages.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-7534

Produtos afetados

Points/Rewards For Woocommerce

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-7534 · Nota de Segurança
• https://wordfence.com/threat-intel/vulnerabilities/id/366b5051-d042-4425-9aad-b77d93bcd485?source=cve · Nota
• https://codecanyon.net/item/sumo-reward-points-woocommerce-reward-system/7791451 · Nota