CVE-2026-123462 · Package
NO FIX YET · SEE WHAT TO DO
The myCred plugin for WordPress has a missing authorization check, which the advisory ties to incorrectly configured access control security levels. An attacker may be able to perform actions or read data they should not be allowed to reach.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the myCred plugin version 4.0.2 or earlier, typically WordPress sites that use it for points or rewards. The sources do not describe which access control settings are needed to reach the flaw, so unknown whether a default install is exposed.
Not affected if plugin-not-installed
Who cares mycred, self-hosted, wordpress
mycred plugin header of the main plugin file.4.0.2 or lower.4.0.2; the sources do not name the exact fixed release.Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.