{"id":"CVE-2026-97073","kind":"vulnerability","aliases":["CVE-2026-97073"],"related":[],"title":"myCred WordPress plugin: missing authorization lets users bypass access controls","description":"Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.","summary":"The myCred plugin for WordPress has a missing authorization check that allows access control settings to be exploited. An attacker can reach functions they should not be allowed to use.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mycred","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed myCred version in the WordPress plugins list, or with `wp plugin get mycred --field=version` if WP-CLI is available.\n- Confirm whether the installed version is `4.0.2` or earlier.","fix":"- myCred: fixed version unknown; the sources only state that versions through `4.0.2` are affected.","status":"open","published_at":"2026-10-29T15:17:25+00:00","first_seen_at":"2026-10-29T15:25:40+00:00","triaged_at":"2026-10-29T15:26:47+00:00","updated_at":"2026-10-29T15:26:47+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-29T15:26:47Z","model":"claude-haiku-5-5","output":{"fix":"- myCred: fixed version unknown; the sources only state that versions through `4.0.2` are affected.","reach":"internet","title":"myCred WordPress plugin: missing authorization lets users bypass access controls","impact":"medium","summary":"The myCred plugin for WordPress has a missing authorization check that allows access control settings to be exploited. An attacker can reach functions they should not be allowed to use.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","mycred","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized users may reach restricted myCred functions on the site","analyst_note":"Check the NVD entry and the WordPress plugin changelog for the fixed version and the exact affected function and required role.","how_to_check":"- Check the installed myCred version in the WordPress plugins list, or with `wp plugin get mycred --field=version` if WP-CLI is available.\n- Confirm whether the installed version is `4.0.2` or earlier.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the myCred plugin for WordPress at version `4.0.2` or earlier are in scope. The sources do not say which myCred features or roles are required to reach the flawed check, so the exposed configuration is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000672,"input_tokens":4100,"output_tokens":524,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-97073':13A,16A '4.0.2':74C 'access':9A,35B,64C 'affect':69C 'allow':34B,50B,60C 'attack':42B 'author':5A,31B,54C 'bypass':8A 'check':32B 'configur':63C 'control':10A,36B,65C 'cve':11A,14A 'exploit':40B,61C 'function':45B 'host':21B 'incorrect':62C 'issu':68C 'let':6A 'levels.this':67C 'miss':4A,30B,53C 'mycr':1A,17B,24B,57C,58C,59C,70C 'n/a':72C 'packag':18B 'plugin':3A,25B 'reach':44B 'secur':66C 'self':20B 'self-host':19B 'set':37B 'use':52B 'user':7A 'vulner':55C 'wordpress':2A,22B,27B","nicknames":[],"mitigations":[],"who_affected":"Sites running the myCred plugin for WordPress at version `4.0.2` or earlier are in scope. The sources do not say which myCred features or roles are required to reach the flawed check, so the exposed configuration is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T15:17:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-97073","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97073","severity":null,"published_at":"2026-10-29T15:17:25+00:00","modified_at":"2026-10-29T15:18:54+00:00","first_seen_at":"2026-10-29T15:25:40+00:00","fetched_at":"2026-10-29T15:25:40+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}