Attack Chain

1. An unauthenticated attacker crafts a malicious HTTP POST request containing JavaScript payload within the reason parameter.
2. The attacker sends this request to the vulnerable REST API endpoint /wp-json/wc-srp/v1/earning.
3. Due to the user_has_cap filter unconditionally granting rs_earning_read capability to all users, the request is processed even without authentication.
4. The create_items() function processes the request without properly sanitizing the reason parameter, storing the malicious script in the reward points log.
5. An administrator later accesses the WordPress admin dashboard and navigates to the Master Log or User Reward Points admin pages.
6. The column_default() method of SRP_Master_Log retrieves the stored log entry without proper output escaping.
7. The malicious JavaScript injected by the attacker executes within the administrator's browser context.
8. The attacker gains control over the administrator's session, performs actions on their behalf, or redirects them to a malicious site.

Impact

Successful exploitation of CVE-2026-7534 leads to unauthenticated Stored Cross-Site Scripting, allowing attackers to execute arbitrary malicious scripts within the browser of any administrator viewing the affected log pages. This can result in session hijacking, complete administrative control over the WordPress site, redirection to phishing sites, or further client-side attacks. The wide adoption of WordPress and this plugin means that a significant number of websites are potentially at risk, and exploitation could lead to substantial data breaches, website defacement, or malware distribution to site visitors. The CVSS v3.1 Base Score of 7.2 indicates a high severity risk.

Recommendation

• Deploy the provided Sigma rule to your SIEM to detect attempts at exploiting CVE-2026-7534 against the /wp-json/wc-srp/v1/earning endpoint.
• Monitor web server access logs for HTTP POST requests containing script-like content in the query parameters targeting /wp-json/wc-srp/v1/earning.
• Patch CVE-2026-7534 by updating the SUMO Reward Points plugin for WordPress to a version greater than 32.7.0 immediately.
• Implement a Web Application Firewall (WAF) with rules to detect and block XSS payloads in request parameters, specifically for the /wp-json/wc-srp/v1/earning REST API endpoint.