myCred CVE-2026-97072

Exploitation requires an authenticated account with at least low-level privileges on the target WordPress site (per PR:L) - it is NOT remote-unauthenticated. The affected product is the myCred plugin at any version up to and including 4.0.2. The specific feature, endpoint, or action lacking the authorization check is not named in the available sources; the description states only that the flaw stems from incorrectly configured access-control security levels, so the exact trigger is not described in the available sources and should be confirmed from the Patchstack advisory. Limiting factors that reduce real-world risk: an attacker must first obtain a valid low-privilege WordPress account on the site, impact is confined to integrity (no data theft or denial of service), and the issue affects only sites running myCred 4.0.2 or earlier.

This is a moderate-severity Missing Authorization flaw (CWE-862) in the myCred WordPress plugin, and the available signals point to a 'patch in normal cycle' issue rather than an urgent fire. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 4.3) indicates a network-reachable, low-complexity attack that nonetheless requires some authenticated privilege (PR:L) and yields only limited integrity impact with no confidentiality or availability impact. The vuln.today decision label is 'this_month', which aligns with the low CVSS and limited impact - not an act_now/emergency item. No EPSS score, no CISA KEV listing, and no confirmed public exploit code are present in the input, so there is no evidence of active or widespread exploitation; the single reference is the Patchstack advisory/database entry, which is an authoritative source record but not a working PoC. Net: a real but low-priority issue - a genuine broken-access-control bug worth patching on a routine monthly cycle, not a high-CVSS-but-illusory risk nor an exploitation emergency. The chief caveat is that the description is terse ('Exploiting Incorrectly Configured Access Control Security Levels') and does not name the specific endpoint or action affected, so the precise impacted functionality must be confirmed against the Patchstack advisory.

An attacker who already holds a low-privilege authenticated account on the WordPress site (consistent with PR:L) sends a crafted request to a myCred function that fails to verify the caller's authorization level, performing an action or modifying state they should not be permitted to. Because attack complexity is low and no user interaction is needed, the request can be issued directly once a foothold account exists; impact is limited to integrity (I:L) with no data disclosure or service disruption. No confirmed public exploit code was identified at time of analysis.