myCred WordPress Plugin CVE-2026-15150

The myCred WordPress plugin must be installed, active, and configured with at least one payment gateway integration that processes external webhook or IPN notifications for credit purchases - sites running myCred without any gateway integration are not exposed. The attacker must have a registered user account on the target site and a valid account with a compatible payment gateway (e.g., PayPal, Stripe) to submit the required payment. No authentication to the WordPress admin panel or elevated privileges on the site are required (CVSS PR:N, consistent with the IPN endpoint being publicly reachable). The limiting factor is that the attacker must spend real money equal to the purchase amount through the gateway, making pure free-currency generation impossible - the attack yields credits at no net loss only if the credits hold greater redeemable value than the payment cost.

The CVSS 5.3 Medium score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) reflects trivially executable network exploitation with no authentication or user interaction required, but records only a Low integrity impact - understating the potential business harm. If myCred credits are redeemable for real goods, discounts, referral bonuses, or digital products, fraudulent credit inflation can cause direct and measurable financial loss to site operators beyond what I:L captures. No EPSS score was provided in the available data, so probabilistic exploitation likelihood cannot be quantified here. The vulnerability is not listed in CISA KEV, indicating no confirmed widespread exploitation campaigns at time of analysis. However, a publicly available exploit exists per WPScan tagging, materially lowering the barrier for abuse. The combination of zero-complexity network exploitation, no authentication requirement, and public exploit code means operators running myCred payment integrations should prioritize patching promptly rather than deferring this to a standard patch cycle - the CVSS score alone may lead teams to deprioritize a flaw with real economic consequences.

An attacker registers a user account on a target WordPress site running a vulnerable version of myCred with a payment gateway integration enabled. They complete a payment through the integrated gateway - for example PayPal or Stripe - to a merchant account they control, satisfying the gateway's payment validation for the required amount. They then trigger the resulting IPN or webhook notification to the target site; because myCred does not verify that the notified payment was directed to the site's own merchant account, it credits the attacker's site account with the corresponding in-site currency. A publicly available exploit exists per WPScan, making this a low-effort attack.