{"id":"CVE-2026-114698","kind":"vulnerability","aliases":["CVE-2026-114698"],"related":[],"title":"myCred WordPress plugin: authorization bypass through user-controlled key","description":"Authorization Bypass Through User-Controlled Key vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.0-beta.1.","summary":"The myCred WordPress plugin mishandles a user-controlled key in an access control check, letting a request bypass authorization. An attacker who gets past that check can perform actions the site intended to restrict.","severity":"medium","cvss":5.4,"epss":0.00185,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mycred","package","self-hosted","wordpress"],"not_affected_if":["patched-version","plugin-not-installed"],"how_to_check":"- Check the installed myCred plugin version in the WordPress admin plugins list or in `wp-content/plugins/mycred/mycred.php`\n- Compare against the affected range: from n/a through `4.0.0-beta.1`","fix":"- Update myCred to a version later than `4.0.0-beta.1` once the vendor releases a fix (fixed version unknown from sources)\n- Until patched, restrict access to myCred administrative endpoints where possible","status":"open","published_at":"2026-10-22T09:17:15+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:14:22+00:00","updated_at":"2026-10-25T04:14:22+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-25T04:14:22Z","model":"claude-haiku-5-5","output":{"fix":"- Update myCred to a version later than `4.0.0-beta.1` once the vendor releases a fix (fixed version unknown from sources)\n- Until patched, restrict access to myCred administrative endpoints where possible","reach":"internet","title":"myCred WordPress plugin: authorization bypass through user-controlled key","impact":"medium","summary":"The myCred WordPress plugin mishandles a user-controlled key in an access control check, letting a request bypass authorization. An attacker who gets past that check can perform actions the site intended to restrict.","category":"package","nicknames":[],"who_cares":["wordpress","mycred","self-hosted"],"confidence":0.4,"needs_auth":"unknown","worst_case":"Attacker bypasses access control and performs restricted plugin actions","analyst_note":"Confirm the fixed version and the exact vulnerable endpoint or setting from the NVD entry and the vendor changelog.","how_to_check":"- Check the installed myCred plugin version in the WordPress admin plugins list or in `wp-content/plugins/mycred/mycred.php`\n- Compare against the affected range: from n/a through `4.0.0-beta.1`","needs_analyst":true,"not_affected_if":["plugin-not-installed","patched-version"],"who_is_affected":"Sites running the myCred plugin up to and including `4.0.0-beta.1` are in the affected range. Exposure depends on the access control settings the site has configured for myCred, which the sources describe as incorrectly configured security levels. Sites not running myCred can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000621,"input_tokens":3352,"output_tokens":571,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114698':13A,16A '-2026':12A,15A '4.0.0':84C 'access':35B,74C 'action':52B 'affect':79C 'allow':70C 'attack':44B 'author':4A,42B,58C 'beta.1':85C 'bypass':5A,41B,59C 'check':37B,49B 'configur':73C 'control':9A,31B,36B,63C,75C 'cve':11A,14A 'exploit':71C 'get':46B 'host':21B 'incorrect':72C 'intend':55B 'issu':78C 'key':10A,32B,64C 'let':38B 'levels.this':77C 'mishandl':27B 'mycr':1A,17B,24B,67C,68C,69C,80C 'n/a':82C 'packag':18B 'past':47B 'perform':51B 'plugin':3A,26B 'request':40B 'restrict':57B 'secur':76C 'self':20B 'self-host':19B 'site':54B 'user':8A,30B,62C 'user-control':7A,29B,61C 'vulner':65C 'wordpress':2A,22B,25B","nicknames":[],"mitigations":[],"who_affected":"Sites running the myCred plugin up to and including `4.0.0-beta.1` are in the affected range. Exposure depends on the access control settings the site has configured for myCred, which the sources describe as incorrectly configured security levels. Sites not running myCred can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T09:17:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114698","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114698","severity":null,"published_at":"2026-10-22T09:17:15+00:00","modified_at":"2026-10-22T15:15:23+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114698","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114698","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}