{"id":"CVE-2026-125811","kind":"vulnerability","aliases":["CVE-2026-125811"],"related":[],"title":"myCred WordPress plugin: blind SQL injection through version 4.0.2","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in myCred myCred mycred allows Blind SQL Injection.This issue affects myCred: from n/a through 4.0.2.","summary":"The myCred loyalty-points plugin for WordPress has a blind SQL injection flaw in versions up to 4.0.2. An attacker can send crafted input that alters database queries and slowly extracts stored data, such as user records.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"mycred","fixed":["4.0.3"],"affected":"<= 4.0.2","ecosystem":"wordpress"}],"ecosystems":[],"tags":["authenticated","mycred","package","php","sql-injection","wordpress"],"not_affected_if":["mycred-4.0.3-or-later","plugin-not-installed"],"how_to_check":"- Run `wp plugin get mycred --field=version` or look at Plugins in wp-admin; 4.0.2 or lower is affected, 4.0.3 or later is patched.\n- Exploiting it needs a logged-in account with Contributor rights or higher (Patchstack). Sites that let visitors register as Contributor or above should update first.","fix":"Update myCred to 4.0.3 or later (Patchstack lists 4.0.3 as the patched version; the vendor changelog for 4.0.3, Oct 26 2026, says only 'Security fixes and code improvements').","status":"open","published_at":"2026-11-13T15:17:41+00:00","first_seen_at":"2026-11-13T15:46:18+00:00","triaged_at":"2026-11-13T15:48:16+00:00","updated_at":"2026-11-13T15:49:57+00:00","category":"package","confidence":0.75,"triage":{"at":"2026-11-13T15:48:16Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"myCred WordPress plugin: blind SQL injection through version 4.0.2","impact":"high","summary":"The myCred loyalty-points plugin for WordPress has a blind SQL injection flaw in versions up to 4.0.2. An attacker can send crafted input that alters database queries and slowly extracts stored data, such as user records.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","mycred","php"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"database contents readable by an attacker through blind SQL injection","analyst_note":"Find the fixed myCred version and the vulnerable endpoint or parameter from the NVD entry or the vendor advisory; the sources give only 'through 4.0.2'.","how_to_check":"- Check the installed myCred version in the WordPress admin plugins list, or with `wp plugin get mycred --field=version`\n- Treat any version at or below `4.0.2` as affected","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the myCred plugin on WordPress at version 4.0.2 or earlier are exposed. The sources do not say which myCred features or endpoints are reachable without logging in, so whether an anonymous visitor can trigger it is unknown.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000715,"input_tokens":4538,"output_tokens":522,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed myCred version and the vulnerable endpoint or parameter from the NVD entry or the vendor advisory; the sources give only 'through 4.0.2'.","search":"'-125811':12A,15A '-2026':11A,14A '4.0.2':9A,43B,90C 'affect':85C 'allow':80C 'alter':51B 'attack':45B 'authent':17B 'blind':4A,35B,81C 'command':72C 'craft':48B 'cve':10A,13A 'data':58B 'databas':52B 'element':67C 'extract':56B 'flaw':38B 'improp':63C 'inject':6A,23B,37B,74C 'injection.this':83C 'input':49B 'issu':84C 'loyalti':28B 'loyalty-point':27B 'mycr':1A,18B,26B,77C,78C,79C,86C 'mycred':16A 'n/a':88C 'neutral':64C 'packag':19B 'php':20B 'plugin':3A,30B 'point':29B 'queri':53B 'record':62B 'send':47B 'slowli':55B 'special':66C 'sql':5A,22B,36B,71C,73C,82C 'sql-inject':21B 'store':57B 'use':68C 'user':61B 'version':8A,40B 'vulner':75C 'wordpress':2A,24B,32B","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running the myCred plugin at version 4.0.2 or earlier. Patchstack says the attacker needs an account with at least Contributor privileges, so sites with open registration or many staff and author accounts are most exposed. Sites without myCred, or already on 4.0.3 or later, can skip it. The vulnerable endpoint or parameter is not published.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["mycred"],"ptokens":["mycred"],"labels":["authenticated","high","mycred","package","php","sqlinjection","wordpress"],"campaign_type":null,"search_a":"'-125811':12A,15A '-2026':11A,14A '4.0.2':9A 'blind':4A 'cve':10A,13A 'inject':6A 'mycr':1A 'mycred':16A 'plugin':3A 'sql':5A 'version':8A 'wordpress':2A","search_b":"'4.0.2':43B 'alter':51B 'attack':45B 'authent':17B 'blind':35B 'craft':48B 'data':58B 'databas':52B 'extract':56B 'flaw':38B 'inject':23B,37B 'input':49B 'loyalti':28B 'loyalty-point':27B 'mycr':18B,26B 'packag':19B 'php':20B 'plugin':30B 'point':29B 'queri':53B 'record':62B 'send':47B 'slowli':55B 'sql':22B,36B 'sql-inject':21B 'store':57B 'user':61B 'version':40B 'wordpress':24B,32B","search_c":"'4.0.2':90C 'affect':85C 'allow':80C 'blind':81C 'command':72C 'element':67C 'improp':63C 'inject':74C 'injection.this':83C 'issu':84C 'mycr':77C,78C,79C,86C 'n/a':88C 'neutral':64C 'special':66C 'sql':71C,73C,82C 'use':68C 'vulner':75C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T15:17:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125811","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125811","severity":null,"published_at":"2026-11-13T15:17:41+00:00","modified_at":"2026-11-13T15:17:41+00:00","first_seen_at":"2026-11-13T15:46:18+00:00","fetched_at":"2026-11-13T15:46:18+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-125811:3894","url":"https://patchstack.com/database/wordpress/plugin/mycred/vulnerability/wordpress-mycred-plugin-4-0-2-sql-injection-vulnerability","severity":null,"published_at":"2026-11-13T15:49:57+00:00","modified_at":"2026-11-13T15:49:57+00:00","first_seen_at":"2026-11-13T15:49:57+00:00","fetched_at":"2026-11-13T15:49:57+00:00","note":"Patchstack (CNA, reporter dzaku) page: <=4.0.2, patched 4.0.3, Contributor+ required. Vendor changelog confirms 4.0.3 security fixes but does not name this CVE, so nothing marked verified. Endpoint/parameter not public. No exploitation or PoC seen; not searched on X.","cites":["https://patchstack.com/database/wordpress/plugin/mycred/vulnerability/wordpress-mycred-plugin-4-0-2-sql-injection-vulnerability","https://mycred.me/changelog/"]}],"documents":[{"id":147275,"url":"https://patchstack.com/database/wordpress/plugin/mycred/vulnerability/wordpress-mycred-plugin-4-0-2-sql-injection-vulnerability","title":"Patchstack: myCred <= 4.0.2 SQL Injection (CVE-2026-125811)","kind":"advisory","source":"analyst","publisher":null,"text":"Vulnerable <= 4.0.2; patched 4.0.3; required privilege Contributor; CVSS 8.5; reported by dzaku 5 Nov 2026; published 13 Nov 2026. Patchstack priority Low.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":147276,"url":"https://mycred.me/changelog/","title":"myCred changelog","kind":"vendor","source":"analyst","publisher":null,"text":"4.0.3 [Oct 26, 2026]: FIX - Security fixes and code improvements. 4.0.2 [Oct 24, 2026]: blank pages fix.","published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}