What is the CVSS score of CVE-2026-40794?

CVE-2026-40794 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.3%.

myCred CVE-2026-40794

EUVD-2026-36997 MEDIUM

Missing Authorization (CWE-862)

2026-06-15 Patchstack

GHSA-98j9-frcv-j6pw

Authentication Bypass Mycred

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-accessible WordPress plugin endpoint requires only subscriber authentication (PR:L); integrity-only impact because attackers alter points/reward data but gain no confidentiality or availability leverage.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 23:06 vuln.today

DescriptionCVE.org

Subscriber Broken Access Control in myCred <= 3.0.3 versions.

AnalysisAI

Broken access control in the myCred WordPress plugin (all versions through 3.0.3) allows authenticated users with only subscriber-level privileges to bypass authorization checks and perform actions reserved for higher-privileged roles, yielding high integrity impact on affected installations. The root cause is missing authorization enforcement (CWE-862) on one or more plugin endpoints, meaning the plugin executes sensitive operations - such as manipulating loyalty points or reward data - without verifying the requesting user's actual capabilities. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, but the low complexity and no-user-interaction requirement make exploitation straightforward for any attacker holding a valid account.

Technical ContextAI

myCred is a WordPress plugin that implements gamification systems including loyalty points, badges, and reward management for WordPress sites. CWE-862 (Missing Authorization) describes a failure to enforce access control checks before executing a privileged action - in WordPress terms, this means the plugin does not verify the current user's capabilities (e.g., via current_user_can()) before processing a sensitive request. The CVSS vector confirms network delivery (AV:N) with low attack complexity (AC:L), subscriber-level authentication (PR:L), and no user interaction (UI:N). The scope is unchanged (S:U), indicating the impact is contained to the myCred plugin's own data plane rather than escaping to the broader WordPress installation. The affected CPE is cpe:2.3:a:mycred:mycred:*:*:*:*:*:*:*:*, covering all versions through 3.0.3 as reported by Patchstack and corroborated by ENISA EUVD-2026-36997.

RemediationAI

No patched version is explicitly identified in the available intelligence data; the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/mycred/vulnerability/wordpress-mycred-plugin-3-0-3-broken-access-control-vulnerability should be checked for the confirmed fix version and upgrade instructions. As an immediate compensating control, administrators should disable open user registration (WordPress Admin > Settings > General > uncheck 'Anyone can register') to eliminate the self-registration path that lowers the attack barrier to zero - this has no impact on existing accounts but prevents new attacker-controlled subscriber accounts from being created. Where disabling registration is not feasible, consider applying a web application firewall rule to restrict POST requests to myCred plugin endpoints from subscriber-role sessions, accepting the trade-off that legitimate subscriber-facing myCred features may be disrupted. Sites should also audit recent myCred point transaction logs for anomalous self-crediting or unexpected reward redemptions as indicators of prior exploitation.