{
 "id": "WPSEC-2026-1527",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1527/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1527/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1527/index.md",
 "title": "myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 4.0.0 - Authenticated (Contributor+) Missing Authorization to Withdrawal Payout and Arbitrary Post Deletion via cashCRED REST API",
 "description": "The myCRED plugin for WordPress is vulnerable to unauthorized access and modification of data via the cashCRED withdrawal REST API routes in all versions up to, and including, 4.0.0. This is due to the list, pay, trash, restore and bulk endpoints only checking for the edit_posts or delete_posts capabilities and not validating the post type or per-post permissions of the supplied IDs. This makes it possible for authenticated attackers, with Contributor-level access and above, to view withdrawal requests, approve and pay out withdrawals, and trash, restore or permanently delete arbitrary posts by ID.",
 "plugin": {
  "slug": "mycred",
  "name": "myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program",
  "full_name": "Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred",
  "wordpress_org": "https://wordpress.org/plugins/mycred/",
  "advisories_url": "https://wpsec.com/vuln/plugin/mycred/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/mycred"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.6,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.0.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.0.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.0.1",
 "remediation": "Update to 4.0.1 or later.",
 "fix_released": "2026-10-22T14:43:16+00:00",
 "published": "2026-10-23T14:43:26+00:00",
 "updated": "2026-10-23T07:09:17.400761+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1527/",
  "https://plugins.svn.wordpress.org/mycred/tags/4.0.1/",
  "https://wordpress.org/plugins/mycred/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/mycred",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-23"
 }
}