{"id":"CVE-2026-115962","kind":"vulnerability","aliases":["CVE-2026-115962"],"related":[],"title":"myCred WordPress plugin: authentication bypass lets attackers spoof identities","description":"Authentication Bypass by Spoofing vulnerability in myCred myCred mycred allows Identity Spoofing.This issue affects myCred: from n/a through 4.0.1.","summary":"myCred is a WordPress plugin for points and rewards. A flaw lets an attacker act as another user (identity spoofing) in versions up to 4.0.1.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mycred","runtime","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed myCred plugin version in the WordPress admin under Plugins.\n- Confirm whether the site runs myCred at all.","fix":"- Move myCred to a version newer than `4.0.1`; the exact fixed version is unknown.","status":"open","published_at":"2026-10-29T11:17:30+00:00","first_seen_at":"2026-10-29T11:24:28+00:00","triaged_at":"2026-10-29T11:25:38+00:00","updated_at":"2026-10-29T11:25:38+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-29T11:25:38Z","model":"claude-haiku-5-5","output":{"fix":"- Move myCred to a version newer than `4.0.1`; the exact fixed version is unknown.","reach":"internet","title":"myCred WordPress plugin: authentication bypass lets attackers spoof identities","impact":"medium","summary":"myCred is a WordPress plugin for points and rewards. A flaw lets an attacker act as another user (identity spoofing) in versions up to 4.0.1.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["wordpress","mycred"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker acts as another user on the site","analyst_note":"Find the fixed myCred version and whether authentication is needed, via the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-115962 and the plugin changelog.","how_to_check":"- Check the installed myCred plugin version in the WordPress admin under Plugins.\n- Confirm whether the site runs myCred at all.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the myCred WordPress plugin at version 4.0.1 or earlier are exposed. Sites without myCred can skip it. The sources do not say which configurations or roles are needed to exploit it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000664,"input_tokens":4095,"output_tokens":508,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115962':12A,15A '-2026':11A,14A '4.0.1':43B,62C 'act':33B 'affect':57C 'allow':53C 'anoth':35B 'attack':7A,32B 'authent':4A,44C 'bypass':5A,45C 'cve':10A,13A 'flaw':29B 'ident':9A,37B,54C 'issu':56C 'let':6A,30B 'mycr':1A,16B,19B,50C,51C,52C,58C 'n/a':60C 'plugin':3A,23B 'point':25B 'reward':27B 'runtim':17B 'spoof':8A,38B,47C 'spoofing.this':55C 'user':36B 'version':40B 'vulner':48C 'wordpress':2A,18B,22B","nicknames":[],"mitigations":[],"who_affected":"Sites running the myCred WordPress plugin at version 4.0.1 or earlier are exposed. Sites without myCred can skip it. The sources do not say which configurations or roles are needed to exploit it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T11:17:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115962","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115962","severity":null,"published_at":"2026-10-29T11:17:30+00:00","modified_at":"2026-10-29T11:17:30+00:00","first_seen_at":"2026-10-29T11:24:28+00:00","fetched_at":"2026-10-29T11:24:28+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}