myCred CVE-2026-97073

Exploitation requires network access to a WordPress site running myCred version 4.0.2 or earlier; per the CVSS vector (PR:N, UI:N) no authentication or user interaction is needed. The CVE describes the root cause as incorrectly configured access-control security levels (Missing Authorization), but the available sources do not name the exact endpoint, parameter, or plugin feature that lacks the authorization check, nor whether any non-default configuration is required - so the precise trigger is not described in the available sources. Limiting factors: impact is confined to low confidentiality (C:L, I:N, A:N), meaning the realistic result is restricted-data disclosure rather than modification or site takeover, and exploitation is bounded to sites that have the myCred plugin installed and active.

This is a moderate-severity, low-urgency issue rather than an emergency. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3) describes a network-reachable, low-complexity, unauthenticated flaw whose only impact is low confidentiality (C:L) with no integrity or availability impact - consistent with a CWE-862 Missing Authorization issue that exposes data or an action that should be access-controlled. No EPSS score is provided in the input, so exploitation probability cannot be quantified. The vulnerability is NOT listed in CISA KEV, and no verified exploit code is supplied - the single reference is a Patchstack advisory page, not a working PoC. The vuln.today decision label is 'this_month', which aligns with the signals: credible vendor reporting (Patchstack) and network-unauthenticated reach, but limited (confidentiality-only, low) impact and no evidence of active exploitation. Treat as a routine patch-cycle item, not a drop-everything priority. Key missing data to note explicitly: no EPSS value, no confirmed fixed version in the evidence, and the exact protected resource exposed by the missing authorization check is not described in the available sources.

An unauthenticated remote attacker sends a request to a myCred plugin endpoint (REST route, AJAX action, or similar) that fails to verify the caller's authorization, causing the plugin to disclose information that should be restricted. Because the impact is limited to low confidentiality with no integrity or availability effect, the realistic outcome is leakage of protected data rather than account takeover or site compromise. No verified public exploit code is identified; only a Patchstack advisory reference exists.