---
id: "CVE-2026-123462"
page: "https://infrastack.ai/live/CVE-2026-123462"
kind: "vulnerability"
aliases: ["CVE-2026-123462"]
title: "myCred WordPress plugin: missing authorization check exposes access control"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["mycred", "package", "self-hosted", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-07T13:16:36+00:00"
first_seen_at: "2026-11-07T13:47:26+00:00"
updated_at: "2026-11-07T13:49:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123462", "first_seen_at": "2026-11-07T13:47:26+00:00"}]
exploit_sources: []
---

# myCred WordPress plugin: missing authorization check exposes access control

Link for people: https://infrastack.ai/live/CVE-2026-123462 (this .md is for agents)

The myCred plugin for WordPress has a missing authorization check, which the advisory ties to incorrectly configured access control security levels. An attacker may be able to perform actions or read data they should not be allowed to reach.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed myCred plugin version in the WordPress admin under Plugins, or in the `mycred` plugin header of the main plugin file.
- Confirm whether the installed version is `4.0.2` or lower.

## Fix

- Update myCred to a version later than `4.0.2`; the sources do not name the exact fixed release.

## Timeline

- 2026-11-07T13:47:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123462

## From the sources

Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_