Live › vulnerability › CVE-2026-115962
myCred is a WordPress plugin for points and rewards. A flaw lets an attacker act as another user (identity spoofing) in versions up to 4.0.1.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 11:24 UTC. All times on this page are UTC.
Sites running the myCred WordPress plugin at version 4.0.1 or earlier are exposed. Sites without myCred can skip it. The sources do not say which configurations or roles are needed to exploit it.
No product ranges from the sources yet.
4.0.1; the exact fixed version is unknown.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Authentication Bypass by Spoofing vulnerability in myCred myCred mycred allows Identity Spoofing.This issue affects myCred: from n/a through 4.0.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-115962")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.