{"id":"CVE-2026-124274","kind":"vulnerability","aliases":["CVE-2026-124274"],"related":[],"title":"myCred WordPress plugin: missing authorization check exposes access control","description":"Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.","summary":"The myCred WordPress plugin has a missing authorization check in its access control settings, versions through 4.0.2. The sources do not say what an attacker can change or read once past it.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mycred","package","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed myCred plugin version in the WordPress admin Plugins screen; versions through `4.0.2` are reported affected.","fix":"- Move myCred to a version newer than `4.0.2`; the sources do not name the exact fixed release.","status":"open","published_at":"2026-11-07T09:17:15+00:00","first_seen_at":"2026-11-07T09:46:25+00:00","triaged_at":"2026-11-07T09:47:58+00:00","updated_at":"2026-11-07T09:47:58+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-07T09:47:58Z","model":"claude-haiku-5-5","output":{"fix":"- Move myCred to a version newer than `4.0.2`; the sources do not name the exact fixed release.","reach":"unknown","title":"myCred WordPress plugin: missing authorization check exposes access control","impact":"medium","summary":"The myCred WordPress plugin has a missing authorization check in its access control settings, versions through 4.0.2. The sources do not say what an attacker can change or read once past it.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","mycred"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown access control bypass on affected WordPress sites","analyst_note":"Confirm the fixed myCred version and what the missing authorization check actually exposes, using the NVD entry and the vendor changelog.","how_to_check":"- Check the installed myCred plugin version in the WordPress admin Plugins screen; versions through `4.0.2` are reported affected.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"unknown. The sources describe a WordPress plugin, myCred, with a missing authorization check in its access control security levels, affecting versions through 4.0.2. Sites running that plugin version are the likely exposed set; sites without myCred can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000674,"input_tokens":4200,"output_tokens":507,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124274':12A,15A '-2026':11A,14A '4.0.2':35B,71C 'access':8A,30B,61C 'affect':66C 'allow':57C 'attack':43B 'author':5A,26B,51C 'chang':45B 'check':6A,27B 'configur':60C 'control':9A,31B,62C 'cve':10A,13A 'exploit':58C 'expos':7A 'incorrect':59C 'issu':65C 'levels.this':64C 'miss':4A,25B,50C 'mycr':1A,16B,20B,54C,55C,56C,67C 'n/a':69C 'packag':17B 'past':49B 'plugin':3A,22B 'read':47B 'say':40B 'secur':63C 'set':32B 'sourc':37B 'version':33B 'vulner':52C 'wordpress':2A,18B,21B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","mycred","package","wordpress"],"campaign_type":null,"search_a":"'-124274':12A,15A '-2026':11A,14A 'access':8A 'author':5A 'check':6A 'control':9A 'cve':10A,13A 'expos':7A 'miss':4A 'mycr':1A 'plugin':3A 'wordpress':2A","search_b":"'4.0.2':35B 'access':30B 'attack':43B 'author':26B 'chang':45B 'check':27B 'control':31B 'miss':25B 'mycr':16B,20B 'packag':17B 'past':49B 'plugin':22B 'read':47B 'say':40B 'set':32B 'sourc':37B 'version':33B 'wordpress':18B,21B","search_c":"'4.0.2':71C 'access':61C 'affect':66C 'allow':57C 'author':51C 'configur':60C 'control':62C 'exploit':58C 'incorrect':59C 'issu':65C 'levels.this':64C 'miss':50C 'mycr':54C,55C,56C,67C 'n/a':69C 'secur':63C 'vulner':52C","first_public_at":"2026-11-07T09:17:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124274","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124274","severity":null,"published_at":"2026-11-07T09:17:15+00:00","modified_at":"2026-11-07T09:17:15+00:00","first_seen_at":"2026-11-07T09:46:25+00:00","fetched_at":"2026-11-07T09:46:25+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}