myCred EUVD-2026-116093

Exploitation requires an existing authenticated account on the target WordPress site at low privilege (CVSS PR:L), consistent with a Missing Authorization flaw where the attacker is already a logged-in user (e.g. subscriber/customer level) and abuses a myCred action that fails to enforce the correct capability check. The affected software is the myCred WordPress plugin, versions from n/a through 4.0.2. No user interaction is needed (UI:N) and the vector is network-reachable (AV:N). LIMITING FACTORS: the attacker must first obtain a valid account on the site, so sites that do not allow self-registration or that restrict account creation substantially raise the bar; impact is limited to integrity (C:N/A:N), so no data disclosure or denial of service results. The exact vulnerable action/endpoint and the precise unauthorized operation are not described in the available sources.

This is a genuine but low-to-moderate priority issue, not a top-tier emergency. The CVSS 3.1 base score is 4.3 (medium), driven by a network attack vector with low complexity but requiring privileges (AV:N/AC:L/PR:L/UI:N) and yielding only limited integrity impact with no confidentiality or availability loss (C:N/I:L/A:N) - consistent with a CWE-862 Missing Authorization flaw where an already-authenticated low-privilege user performs an action they should not be allowed to. No EPSS score was supplied, so exploitation probability cannot be quantified from the input. The vulnerability is NOT on the CISA KEV list and there is no confirmed active exploitation. The only reference is a Patchstack advisory (an analysis/catalog entry), not verified working exploit code, so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_month', which aligns with the medium severity and absence of active-exploitation signals: a flaw worth patching on a normal cycle rather than an out-of-band scramble. The main caveat is that the description is terse ('Exploiting Incorrectly Configured Access Control Security Levels') and does not name the specific endpoint or action affected, so the precise real-world impact of the integrity change is unverified from the available data.

An attacker who already holds a low-privilege authenticated account on the WordPress site (for example a registered subscriber on a site where myCred manages points/gamification) sends a crafted request to a myCred action that lacks a proper capability/authorization check, performing an operation reserved for higher-privilege users. Given AV:N/AC:L and I:L, this allows limited unauthorized modification of data over the network without user interaction. No public exploit code is identified at time of analysis, and the specific affected endpoint is not described in the available sources.