{"id":"CVE-2026-103077","kind":"vulnerability","aliases":["CVE-2026-103077"],"related":[],"title":"myCred WordPress plugin: missing authorization lets users bypass access controls","description":"Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.","summary":"The myCred WordPress loyalty-points plugin has a missing authorization check in versions through 4.0.2. An attacker can exploit incorrectly configured access control levels to perform actions they should not be allowed to.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mycred","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed myCred version in the WordPress plugins list or the plugin header of `mycred.php`\n- Confirm whether the site runs myCred at all","fix":"- myCred through `4.0.2`: unknown fixed version in the sources","status":"open","published_at":"2026-11-03T17:17:52+00:00","first_seen_at":"2026-11-03T17:21:54+00:00","triaged_at":"2026-11-03T17:24:40+00:00","updated_at":"2026-11-03T17:24:40+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-03T17:24:40Z","model":"claude-haiku-5-5","output":{"fix":"- myCred through `4.0.2`: unknown fixed version in the sources","reach":"internet","title":"myCred WordPress plugin: missing authorization lets users bypass access controls","impact":"medium","summary":"The myCred WordPress loyalty-points plugin has a missing authorization check in versions through 4.0.2. An attacker can exploit incorrectly configured access control levels to perform actions they should not be allowed to.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","myCred","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized actions on the site, depending on the affected feature","analyst_note":"Find the fixed myCred version and the affected endpoints or roles in the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-103077 or the plugin's changelog.","how_to_check":"- Check the installed myCred version in the WordPress plugins list or the plugin header of `mycred.php`\n- Confirm whether the site runs myCred at all","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the myCred plugin version 4.0.2 or earlier. The sources do not say which access control settings or roles are needed to trigger the flaw, so the exact exposure is unknown. Sites that do not run myCred can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000683,"input_tokens":4100,"output_tokens":545,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-103077':13A,16A '-2026':12A,15A '4.0.2':38B,77C 'access':9A,45B,67C 'action':50B 'affect':72C 'allow':55B,63C 'attack':40B 'author':5A,33B,57C 'bypass':8A 'check':34B 'configur':44B,66C 'control':10A,46B,68C 'cve':11A,14A 'exploit':42B,64C 'host':21B 'incorrect':43B,65C 'issu':71C 'let':6A 'level':47B 'levels.this':70C 'loyalti':27B 'loyalty-point':26B 'miss':4A,32B,56C 'mycr':1A,17B,24B,60C,61C,62C,73C 'n/a':75C 'packag':18B 'perform':49B 'plugin':3A,29B 'point':28B 'secur':69C 'self':20B 'self-host':19B 'user':7A 'version':36B 'vulner':58C 'wordpress':2A,22B,25B","nicknames":[],"mitigations":[],"who_affected":"Sites running the myCred plugin version 4.0.2 or earlier. The sources do not say which access control settings or roles are needed to trigger the flaw, so the exact exposure is unknown. Sites that do not run myCred can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","mycred","package","selfhosted","wordpress"],"campaign_type":null,"first_public_at":"2026-11-03T17:17:52+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103077","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103077","severity":null,"published_at":"2026-11-03T17:17:52+00:00","modified_at":"2026-11-03T17:17:52+00:00","first_seen_at":"2026-11-03T17:21:54+00:00","fetched_at":"2026-11-03T17:21:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}