EUVD-2026-112736
GHSA-3f2c-qxpp-ff5f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege user
-
ExploitCraft spoofed identity request
-
ExecutionBypass authentication check
-
ImpactPerform unauthorized integrity action
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Anti-spoofing controls
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Per the CVSS vector (PR:L), exploitation requires an already-authenticated low-privilege account on a WordPress site running the myCred plugin version n/a through 4.0.1; it is not remote-unauthenticated and needs no user interaction (UI:N). The specific product feature, endpoint, or configuration that enables the identity spoofing is not described in the available sources. Limiting factors: the attacker must first obtain valid low-privilege credentials, impact is confined to integrity (no data disclosure or denial of service), and the affected software must be the myCred plugin at or below 4.0.1. |
| Impact | This is a moderate-severity (CVSS 4.3) authentication-bypass-by-spoofing / identity-spoofing issue (CWE-290) in the myCred WordPress plugin through 4.0.1. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) indicates a network-reachable, low-complexity attack that requires low-level privileges (PR:L), meaning an attacker must already hold an authenticated low-privilege account; impact is limited to integrity (I:L) with no confidentiality or availability effect. The vuln.today decision label is 'this_month' - a routine-patch cadence rather than act_now or emergency. It is NOT in CISA KEV and no EPSS score was supplied, so there is no signal of active or widespread exploitation; the single reference is the Patchstack advisory, which is a vendor database entry, not verified working exploit code. The signals are internally consistent: a low-impact, privilege-requiring flaw with no exploitation evidence. This is a real but non-urgent issue - schedule it into normal patching rather than treating it as a priority emergency. MISSING DATA: no EPSS probability, no SSVC automatable/technical-impact breakdown, and the description does not state the spoofing mechanism, so the precise trigger cannot be confirmed from available sources. |
| Exploit ScenarioDerived | An attacker holding a low-privilege authenticated account on a WordPress site running myCred ≤4.0.1 abuses the spoofing weakness to assume or impersonate another identity, enabling unauthorized integrity-affecting actions within the plugin's context. The exact trigger is not described in the available sources, and no verified working exploit code was provided - only the Patchstack advisory reference exists. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 29, 2026
Identity spoofing in the myCred WordPress plugin through version 4.0.1 lets an attacker with an existing low-privilege account impersonate another identity, subverting the plugin's authentication checks (CWE-290). The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, score 4.3) confirms this is a network-reachable, low-complexity issue that requires valid low-privilege credentials but no user interaction; impact is limited to integrity, with no confidentiality or availability effect. No public exploit code and no CISA KEV entry are indicated in the available data, and the vulnerability is tracked by Patchstack with a 'this_month' priority label rather than emergency or act-now handling.
RemediationAI
No fixed version is listed in the supplied data, so no vendor-released patch version can be cited; the reference resolves to the Patchstack advisory page for the myCred 4.0.1 bypass, which should be checked for an updated plugin release and applied once available. Because the required prerequisite is an authenticated low-privilege account (PR:L), the most direct compensating control is to reduce the population that can reach the spoofable path: audit and prune subscriber and other low-privilege accounts on sites running myCred through 4.0.1, and restrict self-registration and role escalation so untrusted users cannot obtain such accounts, accepting the trade-off that legitimate community or membership signups must be gated. Sites that do not need myCred's points, ranks or transfer features can deactivate the plugin entirely, which removes the exposure but also removes all loyalty functionality. Reviewing plugin-level logging for points, balance or rank changes made under unexpected identities can surface abuse attempts, though it detects rather than prevents the spoofing. No patch-availability statement beyond the absence of a listed fix version should be inferred from the available data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
myCred is a WordPress plugin that implements a points, rewards and loyalty system, including balance management, ranks, badges and transfers between user accounts. The flaw class is CWE-290 (Authentication Bypass by Spoofing): the plugin accepts an identity assertion it cannot adequately bind to the requesting session, so a caller can present itself as a different user and have privileged operations attributed to that impersonated account. The information provided does not identify the specific endpoint, AJAX action, nonce or parameter that is spoofable, so the exact trigger is not described in the available sources. Because the CVSS vector carries PR:L, the attacker must already hold an authenticated low-privilege WordPress account on a site running the affected plugin; the vector carries UI:N and S:U, and scopes impact to integrity only (I:L) with no confidentiality or availability effect. The CPE cpe:2.3:a:mycred:mycred:*:*:*:*:*:*:*:* marks all versions up to and including 4.0.1 as affected, with no platform or configuration restriction recorded.
Know when Mycred gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Network-reachable (AV:N) and low-complexity (AC:L) but requires an authenticated low-privilege account (PR:L); spoofing affects integrity only (I:L), with no confidentiality or availability impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Authentication Bypass by Spoofing vulnerability in myCred myCred mycred allows Identity Spoofing.This issue affects myCred: from n/a through 4.0.1.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
The myCred WordPress plugin before 2.3 does not validate or escape the fields parameter before using it in a SQL stateme
Payment gateway merchant account verification is entirely absent in the myCred WordPress plugin before version 3.2.5, en
The myCred WordPress plugin before 2.4.3.1 does not have authorisation and CSRF checks in its mycred-tools-import-export
The myCred WordPress plugin before 2.4.3.1 does not have any authorisation and CSRF checks in the mycred-tools-import-ex
The myCred WordPress plugin before 2.4.4.1 does not have any authorisation in place in its mycred-tools-select-user AJAX
Broken access control in the Bookify WordPress plugin (versions ≤ 1.1.1) allows authenticated subscriber-level users to
Unauthenticated IDOR in License Manager for WooCommerce (versions <= 3.0.15) allows remote, unauthenticated attackers to
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saad Iqbal myCred
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in myCred myCred - Po
Cross-Site Request Forgery (CSRF) vulnerability in myCred plugin <= 2.5 versions. Rated medium severity (CVSS 6.5), this
Stored XSS in the myCred WordPress plugin (versions through 3.0.4) enables authenticated low-privileged attackers to per
Broken access control in the myCred WordPress plugin (all versions through 3.0.3) allows authenticated users with only s
Exploit-DB