---
id: "CVE-2026-123465"
page: "https://infrastack.ai/live/CVE-2026-123465"
kind: "vulnerability"
aliases: ["CVE-2026-123465"]
title: "myCred: plugin exposes embedded sensitive data to unauthorized users"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["mycred", "package", "self-hosted", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-09T10:17:08+00:00"
first_seen_at: "2026-11-09T10:25:49+00:00"
updated_at: "2026-11-09T10:26:09+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123465", "first_seen_at": "2026-11-09T10:25:49+00:00"}]
exploit_sources: []
---

# myCred: plugin exposes embedded sensitive data to unauthorized users

Link for people: https://infrastack.ai/live/CVE-2026-123465 (this .md is for agents)

The myCred WordPress points plugin exposes sensitive data embedded in its pages to parties who should not see it. An attacker can retrieve that data without authorization.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed myCred version in the WordPress plugins list or the plugin header of `mycred/mycred.php`
- Confirm whether the site runs myCred `4.0.2` or earlier

## Fix

- myCred: no fixed version is named in the sources; upgrade past `4.0.2` once the vendor publishes one

## Timeline

- 2026-11-09T10:25:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123465

## From the sources

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in myCred myCred mycred allows Retrieve Embedded Sensitive Data.This issue affects myCred: from n/a through 4.0.2.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_