CVE-2025-32925 is a high severity (CVSS 8.3) PHP file inclusion flaw in FantasticPlugins' SUMO Reward Points plugin for WordPress, through version 30.7.0. It allows local file inclusion. The record names no fixed version, so update to the latest release or remove the plugin.
What's affected
SUMO Reward Points (plugin slug rewardsystem) through version 30.7.0, per the CVE record, which draws on a Patchstack report. The record has no fixed version, so use the plugin's change log to find the release after 30.7.0.
The vector requires user interaction and rates attack complexity as high, with a changed scope. That combination keeps the score at 8.3 and suggests an attack needs a victim to take an action, such as following a link.
The plugin is aimed at online stores, so check WooCommerce sites in particular, including copies that are not in active use. Stores also hold customer accounts and order data, so a compromise there carries privacy and payment handling consequences beyond the plugin itself.
How to check if you're exposed
Read the installed version:
wp plugin get rewardsystem
Or use the Plugins page in the admin and read the version listed for SUMO Reward Points. Anything at 30.7.0 or lower is in scope.
If you maintain several stores, run the command across all of them and keep the result in a shared sheet so you can verify the update later.
What to do now
- Update SUMO Reward Points to the latest release, after reading its change log.
- If the plugin is not essential, deactivate and remove it.
- Keep PHP and WordPress file permissions tight so the web server user can only read what it needs.
- Train store admins not to follow unexpected links while logged in, since the vector needs user interaction.
- Review web logs for requests to the plugin with path like values.
Why it matters
The class is CWE-98 (PHP File Inclusion). The plugin builds the name of a file to include from a value that a caller can influence. In the local form, the attacker steers the include to files that already exist on the server.
With a changed scope, the effect can reach past the plugin itself into the wider site. That is typical of PHP inclusion issues, since an included file runs with the full rights of the site.
The record does not mark this CVE as CISA KEV and makes no claim of exploitation in the wild.
Quick check
Does this need a logged in user?
The vector shows no privileges required but user interaction needed. Someone has to take an action, such as clicking a link, for the attack to proceed.
Sources
Last reviewed: 18 October 2026.
