What is the CVSS score of CVE-2026-61968?

CVE-2026-61968 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.3%.

myCred CVE-2026-61968

EUVD-2026-43438 MEDIUM

Missing Authorization (CWE-862)

2026-07-13 Patchstack

WordPress Authentication Bypass Mycred Wordpress Plugin Saad Iqbal

5.4

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

5.4 MEDIUM

Network-accessible WordPress endpoint exploitable by any authenticated subscriber (PR:L, AC:L); scope unchanged, no confidentiality loss, only low integrity and availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:16 vuln.today

DescriptionCVE.org

Missing Authorization vulnerability in Saad Iqbal myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through <= 3.1.2.

AnalysisAI

Missing Authorization in the myCred WordPress plugin (all versions through 3.1.2) allows authenticated low-privileged users to exploit incorrectly configured access control levels, resulting in unauthorized integrity and availability impacts against the plugin's loyalty points system. The root cause (CWE-862) indicates the plugin performs sensitive operations without verifying that the requesting user holds the requisite permission level. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.

Technical ContextAI

myCred is a WordPress plugin developed by Saad Iqbal that provides a gamification and loyalty points management system for WordPress sites. The affected CPE (cpe:2.3:a:saad_iqbal:mycred:*:*:*:*:*:*:*:*) covers all released versions up to and including 3.1.2. CWE-862 (Missing Authorization) describes a failure to verify that an authenticated user actually holds the permissions required to execute a requested action - the application trusts that an authenticated session implies sufficient privilege, without performing a discrete capability or role check on the specific operation. This class of flaw is particularly common in WordPress plugins where AJAX handlers or REST API endpoints register callbacks without nonce or capability checks, allowing any authenticated user (including subscribers) to invoke privileged actions.

RemediationAI

The primary remediation is to upgrade the myCred plugin to a version released after 3.1.2 that addresses this missing authorization issue; however, the available data does not specify an exact fixed release version - consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/mycred/vulnerability/wordpress-mycred-plugin-3-1-2-broken-access-control-vulnerability and the WordPress plugin repository for the current patched release. Until a patch is applied, compensating controls include disabling open user registration on affected WordPress sites to prevent untrusted parties from obtaining the low-privileged accounts required for exploitation, and restricting access to the WordPress admin and AJAX endpoints (wp-admin/admin-ajax.php) at the web server or WAF layer for all roles below the minimum trusted level. Note that restricting AJAX endpoints may degrade front-end myCred functionality for legitimate users.