{
 "id": "WPSEC-2026-1528",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1528/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1528/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1528/index.md",
 "title": "myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 4.0.0 - Authenticated (Contributor+) Missing Authorization to Arbitrary Post Deletion via Badges, Ranks and Coupons REST API",
 "description": "The myCRED plugin for WordPress is vulnerable to unauthorized modification of data via the Badges, Ranks and Coupons add-on REST API routes in all versions up to, and including, 4.0.0, due to the permission callbacks only checking for the edit_posts capability and the delete, restore and bulk handlers not checking that the supplied IDs belong to the expected post type or that the user may delete them. This makes it possible for authenticated attackers, with Contributor-level access and above, to trash, restore or permanently delete arbitrary posts, pages and other content on the site, and to modify badge, rank and coupon records.",
 "plugin": {
  "slug": "mycred",
  "name": "myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program",
  "full_name": "Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred",
  "wordpress_org": "https://wordpress.org/plugins/mycred/",
  "advisories_url": "https://wpsec.com/vuln/plugin/mycred/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/mycred"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 8.1,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.0.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.0.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.0.1",
 "remediation": "Update to 4.0.1 or later.",
 "fix_released": "2026-10-22T14:43:16+00:00",
 "published": "2026-10-23T14:43:26+00:00",
 "updated": "2026-10-23T07:09:17.400761+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1528/",
  "https://plugins.svn.wordpress.org/mycred/tags/4.0.1/",
  "https://wordpress.org/plugins/mycred/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/mycred",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-23"
 }
}