Live › vulnerability › CVE-2026-97073
The myCred plugin for WordPress has a missing authorization check that allows access control settings to be exploited. An attacker can reach functions they should not be allowed to use.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 15:25 UTC. All times on this page are UTC.
Sites running the myCred plugin for WordPress at version 4.0.2 or earlier are in scope. The sources do not say which myCred features or roles are required to reach the flawed check, so the exposed configuration is unknown.
No product ranges from the sources yet.
wp plugin get mycred --field=version if WP-CLI is available.4.0.2 or earlier.4.0.2 are affected.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-97073")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.