myCred CVE-2026-40794

Exploitation requires the attacker to hold a valid WordPress account with at minimum subscriber-level privileges, as confirmed by the CVSS PR:L metric - unauthenticated visitors cannot exploit this flaw. The myCred plugin must be installed and active on the target WordPress installation running version 3.0.3 or earlier. On sites with open user self-registration enabled, the authentication barrier is trivially satisfied by creating a new account; on sites with closed registration, the attacker must obtain or compromise an existing subscriber account. No non-default plugin configuration or special feature enablement is identified as a prerequisite in the available data - the broken access control appears to affect the plugin in its standard active state. The primary limiting factors are the authentication requirement (PR:L) and the plugin's presence, meaning the realistic risk surface is open-registration WordPress sites using myCred for loyalty or reward functionality.

The CVSS 6.5 Medium score is driven by network accessibility, low attack complexity, and high integrity impact, tempered by the PR:L requirement (subscriber authentication). No EPSS score was included in the provided intelligence package, so probabilistic exploitation likelihood cannot be quantified from this data. The vulnerability is not listed in the CISA KEV catalog, and no POC code has been confirmed. In practical terms, the PR:L prerequisite is the primary mitigating factor: an attacker must first hold a valid subscriber-level WordPress account. On sites with open user registration, this barrier is trivial - any visitor can self-register and immediately attempt exploitation; on closed-registration sites, the attacker must compromise or socially engineer an existing account. The I:H integrity rating signals that successful exploitation could allow unauthorized manipulation of points balances or reward records, which carries real business impact for organizations running loyalty programs on myCred. CVSS accurately reflects the threat model here - this is a genuine medium-severity issue on registration-open sites and a reduced-priority finding on tightly controlled installations.

An attacker registers a free account on a WordPress site with open user registration, gaining subscriber-level access, then crafts an HTTP request targeting a myCred plugin endpoint that performs a privileged operation such as adjusting a user's point balance. Because the endpoint lacks authorization checks (CWE-862), the plugin processes the request as if the subscriber were a privileged administrator, allowing the attacker to credit themselves with arbitrary loyalty points or trigger unauthorized reward redemptions. No public exploit code has been identified at time of analysis, but the AC:L and UI:N CVSS metrics indicate the attack requires no special conditions or timing beyond holding a valid subscriber account.