What is the CVSS score of CVE-2026-40786?

CVE-2026-40786 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Myrewards CVE-2026-40786

Q: Which versions of Myrewards are affected by CVE-2026-40786?

Authenticated low-privilege users can modify settings in the MyRewards WordPress plugin through missing authorization checks, leading to limited integrity impact. Affected versions are up to 5.7.3.

EUVD-2026-22910 MEDIUM

Missing Authorization (CWE-862)

2026-04-15 Patchstack

GHSA-j6vj-j7q6-95qq

WordPress Authentication Bypass Myrewards Wordpress Plugin

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 15:35 vuln.today

CVSS changed

Apr 16, 2026 - 15:22 NVD

4.3 (MEDIUM)

EUVD ID Assigned

Apr 15, 2026 - 10:45 euvd

EUVD-2026-22910

CVE Published

Apr 15, 2026 - 10:21 nvd

MEDIUM 4.3

DescriptionCVE.org

Missing Authorization vulnerability in Long Watch Studio MyRewards woorewards allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MyRewards: from n/a through <= 5.7.3.

AnalysisAI

Authenticated low-privilege users can modify settings in the MyRewards WordPress plugin through missing authorization checks, leading to limited integrity impact. Affected versions are up to 5.7.3. No active exploitation or public exploit code is known.