EUVD-2026-43438Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Network-accessible WordPress endpoint exploitable by any authenticated subscriber (PR:L, AC:L); scope unchanged, no confidentiality loss, only low integrity and availability impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Lifecycle Timeline
1DescriptionCVE.org
Missing Authorization vulnerability in Saad Iqbal myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through <= 3.1.2.
AnalysisAI
Missing Authorization in the myCred WordPress plugin (all versions through 3.1.2) allows authenticated low-privileged users to exploit incorrectly configured access control levels, resulting in unauthorized integrity and availability impacts against the plugin's loyalty points system. The root cause (CWE-862) indicates the plugin performs sensitive operations without verifying that the requesting user holds the requisite permission level. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid WordPress user account with at minimum subscriber-level privileges (consistent with CVSS PR:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 5.4 (Medium) reflects a network-exploitable flaw requiring low-privilege authentication, with no user interaction and an unchanged scope, yielding low integrity and low availability impact but no confidentiality exposure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a subscriber-level WordPress account on a target site submits a crafted HTTP request directly to the myCred plugin's unguarded endpoint - such as an AJAX action or REST route - invoking a privileged operation without the required capability check. This could enable the attacker to award, deduct, or manipulate loyalty point balances for any user, or invoke administrative myCred functions, impacting both the integrity of the points ledger and potentially the availability of point-dependent features. … |
| Remediation | The primary remediation is to upgrade the myCred plugin to a version released after 3.1.2 that addresses this missing authorization issue; however, the available data does not specify an exact fixed release version - consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/mycred/vulnerability/wordpress-mycred-plugin-3-1-2-broken-access-control-vulnerability and the WordPress plugin repository for the current patched release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
The myCred WordPress plugin before 2.3 does not validate or escape the fields parameter before using it in a SQL stateme
The myCred WordPress plugin before 2.4.3.1 does not have authorisation and CSRF checks in its mycred-tools-import-export
The myCred WordPress plugin before 2.4.3.1 does not have any authorisation and CSRF checks in the mycred-tools-import-ex
The myCred WordPress plugin before 2.4.4.1 does not have any authorisation in place in its mycred-tools-select-user AJAX
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in myCred myCred - Po
Cross-Site Request Forgery (CSRF) vulnerability in myCred plugin <= 2.5 versions. Rated medium severity (CVSS 6.5), this
Broken access control in the myCred WordPress plugin (all versions through 3.0.3) allows authenticated users with only s
Stored XSS in the myCred WordPress plugin (versions through 3.0.4) enables authenticated low-privileged attackers to per
The myCred - Loyalty Points and Rewards plugin for WordPress and WooCommerce - Give Points, Ranks, Badges, Cashback, Woo
The myCred - Loyalty Points and Rewards plugin for WordPress and WooCommerce - Give Points, Ranks, Badges, Cashback, Woo
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today