WordPress SUMO Reward Points Plugin Unauthenticated Stored XSS

The SUMO Reward Points plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REST API endpoint `/wp-json/wc-srp/v1/earning` in versions up to, and including, 32.7.0. This is due to the `user_has_cap` filter in the `SRP_REST_Earning_Controller` class unconditionally granting the custom `rs_earning_read` capability to all users — including unauthenticated visitors — combined with missing sanitization of the `reason` parameter in the `create_items()` function and missing output escaping in the `column_default()` method of `SRP_Master_Log`. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into the reward points log that will execute whenever an administrator accesses the Master Log or User Reward Points admin pages.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The SUMO Reward Points plugin for WordPress contains a critical vulnerability allowing unauthenticated attackers to inject and store malicious JavaScript code through the REST API. The flaw stems from two compounding issues: the plugin's REST controller unconditionally grants the `rs_earning_read` capability to all users regardless of authentication status, and the `reason` parameter in the earning creation endpoint lacks proper sanitization before storage. This means any visitor can craft a malicious REST API request to inject arbitrary scripts that execute in the browsers of site administrators and users who view the affected content. With a CVSS score of 7.2, this vulnerability affects all WordPress installations running the SUMO Reward Points plugin up to version 32.7.0, potentially compromising admin credentials, session tokens, and site integrity.

Casky's 322 mapped skills—powered by Claude's extended reasoning capabilities—would detect this attack across multiple MITRE ATT&CK techniques. For TA0001 (Reconnaissance), practitioners would identify suspicious REST API probing patterns targeting `/wp-json/wc-srp/v1/earning` endpoints. For TA0043 (Reconnaissance via public sources), the skills detect indicators of active exploitation scanning. More critically, the platform's techniques aligned with CWE-79 detection would flag the unsanitized `reason` parameter as it flows from user input through the REST controller without proper escaping, recognizing the stored XSS signature. Practitioners using Casky would see findings highlighting the authentication bypass mechanism combined with the injection point, enabling them to prioritize patching and implement input validation rules before malicious payloads persist in their WordPress databases.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-7534.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-7534

Casky has 322 skills that investigate the attack patterns behind CVE-2026-7534. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn