myCred CVE-2026-61968

Exploitation requires a valid WordPress user account with at minimum subscriber-level privileges (consistent with CVSS PR:L). The attacker must have network access to the target WordPress installation. No special server-side configuration beyond a standard myCred installation on WordPress is required - the vulnerability exists in the plugin's default state. Exploitation is limited by the need for a valid authenticated session; sites with closed user registration significantly reduce the realistic attacker pool. There is no requirement for specific myCred configuration options or non-default settings to trigger the flaw. No user interaction from a victim is required.

The CVSS 3.1 base score of 5.4 (Medium) reflects a network-exploitable flaw requiring low-privilege authentication, with no user interaction and an unchanged scope, yielding low integrity and low availability impact but no confidentiality exposure. The PR:L metric is the primary limiting factor - exploitation demands at minimum a subscriber-level WordPress account, which is non-trivially obtained on sites that do not permit open registration. No EPSS score was provided, and the absence of a KEV listing and any documented POC code suggests opportunistic mass exploitation is not occurring at time of analysis. The Patchstack tag 'Authentication Bypass' may be somewhat misleading: this is not a bypass of authentication itself but rather a bypass of authorization checks post-authentication. Real-world risk is moderate for sites with open user registration enabled, and lower for members-only or closed-registration deployments, where obtaining a valid account is itself a barrier.

An attacker with a subscriber-level WordPress account on a target site submits a crafted HTTP request directly to the myCred plugin's unguarded endpoint - such as an AJAX action or REST route - invoking a privileged operation without the required capability check. This could enable the attacker to award, deduct, or manipulate loyalty point balances for any user, or invoke administrative myCred functions, impacting both the integrity of the points ledger and potentially the availability of point-dependent features. No public proof-of-concept code is documented, but the low complexity and authentication-only barrier make manual exploitation straightforward for any user familiar with WordPress plugin internals.