{"id":"CVE-2026-123462","kind":"vulnerability","aliases":["CVE-2026-123462"],"related":[],"title":"myCred WordPress plugin: missing authorization check exposes access control","description":"Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.","summary":"The myCred plugin for WordPress has a missing authorization check, which the advisory ties to incorrectly configured access control security levels. An attacker may be able to perform actions or read data they should not be allowed to reach.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mycred","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed myCred plugin version in the WordPress admin under Plugins, or in the `mycred` plugin header of the main plugin file.\n- Confirm whether the installed version is `4.0.2` or lower.","fix":"- Update myCred to a version later than `4.0.2`; the sources do not name the exact fixed release.","status":"open","published_at":"2026-11-07T13:16:36+00:00","first_seen_at":"2026-11-07T13:47:26+00:00","triaged_at":"2026-11-07T13:49:29+00:00","updated_at":"2026-11-07T13:49:29+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-07T13:49:29Z","model":"claude-haiku-5-5","output":{"fix":"- Update myCred to a version later than `4.0.2`; the sources do not name the exact fixed release.","reach":"internet","title":"myCred WordPress plugin: missing authorization check exposes access control","impact":"medium","summary":"The myCred plugin for WordPress has a missing authorization check, which the advisory ties to incorrectly configured access control security levels. An attacker may be able to perform actions or read data they should not be allowed to reach.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","mycred","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown access to restricted myCred functions or data on the site","analyst_note":"Check the NVD entry and the myCred changelog for the fixed version and which access control settings trigger the flaw.","how_to_check":"- Check the installed myCred plugin version in the WordPress admin under Plugins, or in the `mycred` plugin header of the main plugin file.\n- Confirm whether the installed version is `4.0.2` or lower.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the myCred plugin version 4.0.2 or earlier, typically WordPress sites that use it for points or rewards. The sources do not describe which access control settings are needed to reach the flaw, so unknown whether a default install is exposed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00069,"input_tokens":4200,"output_tokens":539,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123462':12A,15A '-2026':11A,14A '4.0.2':82C 'abl':47B 'access':8A,39B,72C 'action':50B 'advisori':34B 'affect':77C 'allow':58B,68C 'attack':44B 'author':5A,30B,62C 'check':6A,31B 'configur':38B,71C 'control':9A,40B,73C 'cve':10A,13A 'data':53B 'exploit':69C 'expos':7A 'host':20B 'incorrect':37B,70C 'issu':76C 'level':42B 'levels.this':75C 'may':45B 'miss':4A,29B,61C 'mycr':1A,16B,23B,65C,66C,67C,78C 'n/a':80C 'packag':17B 'perform':49B 'plugin':3A,24B 'reach':60B 'read':52B 'secur':41B,74C 'self':19B 'self-host':18B 'tie':35B 'vulner':63C 'wordpress':2A,21B,26B","nicknames":[],"mitigations":[],"who_affected":"Sites running the myCred plugin version 4.0.2 or earlier, typically WordPress sites that use it for points or rewards. The sources do not describe which access control settings are needed to reach the flaw, so unknown whether a default install is exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","mycred","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-123462':12A,15A '-2026':11A,14A 'access':8A 'author':5A 'check':6A 'control':9A 'cve':10A,13A 'expos':7A 'miss':4A 'mycr':1A 'plugin':3A 'wordpress':2A","search_b":"'abl':47B 'access':39B 'action':50B 'advisori':34B 'allow':58B 'attack':44B 'author':30B 'check':31B 'configur':38B 'control':40B 'data':53B 'host':20B 'incorrect':37B 'level':42B 'may':45B 'miss':29B 'mycr':16B,23B 'packag':17B 'perform':49B 'plugin':24B 'reach':60B 'read':52B 'secur':41B 'self':19B 'self-host':18B 'tie':35B 'wordpress':21B,26B","search_c":"'4.0.2':82C 'access':72C 'affect':77C 'allow':68C 'author':62C 'configur':71C 'control':73C 'exploit':69C 'incorrect':70C 'issu':76C 'levels.this':75C 'miss':61C 'mycr':65C,66C,67C,78C 'n/a':80C 'secur':74C 'vulner':63C","first_public_at":"2026-11-07T13:16:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123462","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123462","severity":null,"published_at":"2026-11-07T13:16:36+00:00","modified_at":"2026-11-07T13:16:37+00:00","first_seen_at":"2026-11-07T13:47:26+00:00","fetched_at":"2026-11-07T13:47:26+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}