Live › vulnerability › CVE-2026-114698
Go to dashboardThe myCred WordPress plugin mishandles a user-controlled key in an access control check, letting a request bypass authorization. An attacker who gets past that check can perform actions the site intended to restrict.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the myCred plugin up to and including 4.0.0-beta.1 are in the affected range. Exposure depends on the access control settings the site has configured for myCred, which the sources describe as incorrectly configured security levels. Sites not running myCred can skip it.
No product ranges from the sources yet.
wp-content/plugins/mycred/mycred.php4.0.0-beta.14.0.0-beta.1 once the vendor releases a fix (fixed version unknown from sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Authorization Bypass Through User-Controlled Key vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.0-beta.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-114698")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.