Live › vulnerability › CVE-2026-97072
The myCred WordPress plugin has a missing authorization vulnerability affecting versions up to and including 4.0.2. A source describes it as exploiting incorrectly configured access control security levels, so a user may be able to perform actions they should not.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 17:21 UTC. All times on this page are UTC.
Sites running the myCred plugin for points or reward systems on WordPress, at versions up to and including 4.0.2. The sources do not say which roles or configurations are required to exploit it, so treat any site with myCred and user-facing access control as potentially affected.
No product ranges from the sources yet.
wp-content/plugins/mycred/mycred.php4.0.2 (the sources do not name the exact fixed release)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-97072")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.