MYCRED · CVE-2026-125811 · Package
FIX → 4.0.3
The myCred loyalty-points plugin for WordPress has a blind SQL injection flaw in versions up to 4.0.2. An attacker can send crafted input that alters database queries and slowly extracts stored data, such as user records.
first public Nov 13, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
WordPress sites running the myCred plugin at version 4.0.2 or earlier. Patchstack says the attacker needs an account with at least Contributor privileges, so sites with open registration or many staff and author accounts are most exposed. Sites without myCred, or already on 4.0.3 or later, can skip it. The vulnerable endpoint or parameter is not published.
Not affected if mycred-4.0.3-or-later, plugin-not-installed
Who cares authenticated, mycred, php, sql-injection, wordpress
wp plugin get mycred --field=version or look at Plugins in wp-admin; 4.0.2 or lower is affected, 4.0.3 or later is patched.Upgrade to 4.0.3
Update myCred to 4.0.3 or later (Patchstack lists 4.0.3 as the patched version; the vendor changelog for , Oct 26 2026, says only ).
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in myCred myCred mycred allows Blind SQL Injection.This issue affects myCred: from n/a through 4.0.2.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
4.0.3Security fixes and code improvements