{"id":"CVE-2026-97072","kind":"vulnerability","aliases":["CVE-2026-97072"],"related":[],"title":"myCred WordPress plugin: missing authorization check exposes access control","description":"Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.","summary":"The myCred WordPress plugin has a missing authorization vulnerability affecting versions up to and including 4.0.2. A source describes it as exploiting incorrectly configured access control security levels, so a user may be able to perform actions they should not.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mycred","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed myCred version in the WordPress plugins screen or the plugin header in `wp-content/plugins/mycred/mycred.php`","fix":"- myCred: a version later than `4.0.2` (the sources do not name the exact fixed release)","status":"open","published_at":"2026-11-03T17:18:16+00:00","first_seen_at":"2026-11-03T17:21:57+00:00","triaged_at":"2026-11-03T17:24:36+00:00","updated_at":"2026-11-03T17:24:36+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-03T17:24:36Z","model":"claude-haiku-5-5","output":{"fix":"- myCred: a version later than `4.0.2` (the sources do not name the exact fixed release)","reach":"internet","title":"myCred WordPress plugin: missing authorization check exposes access control","impact":"medium","summary":"The myCred WordPress plugin has a missing authorization vulnerability affecting versions up to and including 4.0.2. A source describes it as exploiting incorrectly configured access control security levels, so a user may be able to perform actions they should not.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","mycred","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized users may reach restricted plugin functions","analyst_note":"Confirm the fixed myCred version and the specific vulnerable endpoint or role from the vendor advisory or the NVD entry.","how_to_check":"- Check the installed myCred version in the WordPress plugins screen or the plugin header in `wp-content/plugins/mycred/mycred.php`\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the myCred plugin for points or reward systems on WordPress, at versions up to and including 4.0.2. The sources do not say which roles or configurations are required to exploit it, so treat any site with myCred and user-facing access control as potentially affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000679,"input_tokens":4100,"output_tokens":537,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-97072':12A,15A '4.0.2':37B,80C 'abl':55B 'access':8A,46B,70C 'action':58B 'affect':31B,75C 'allow':66C 'author':5A,29B,60C 'check':6A 'configur':45B,69C 'control':9A,47B,71C 'cve':10A,13A 'describ':40B 'exploit':43B,67C 'expos':7A 'host':20B 'includ':36B 'incorrect':44B,68C 'issu':74C 'level':49B 'levels.this':73C 'may':53B 'miss':4A,28B,59C 'mycr':1A,16B,23B,63C,64C,65C,76C 'n/a':78C 'packag':17B 'perform':57B 'plugin':3A,25B 'secur':48B,72C 'self':19B 'self-host':18B 'sourc':39B 'user':52B 'version':32B 'vulner':30B,61C 'wordpress':2A,21B,24B","nicknames":[],"mitigations":[],"who_affected":"Sites running the myCred plugin for points or reward systems on WordPress, at versions up to and including 4.0.2. The sources do not say which roles or configurations are required to exploit it, so treat any site with myCred and user-facing access control as potentially affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","mycred","package","selfhosted","wordpress"],"first_public_at":"2026-11-03T17:18:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-97072","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97072","severity":null,"published_at":"2026-11-03T17:18:16+00:00","modified_at":"2026-11-03T17:18:16+00:00","first_seen_at":"2026-11-03T17:21:57+00:00","fetched_at":"2026-11-03T17:21:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}