myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 4.0.0 - Unauthenticated Insufficient Verification of Data Authenticity to Point Purchase Payment Bypass via Skrill IPN Handler
- ID
- WPSEC-2026-1529
- Plugin
- Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred (mycred)
- Affected
- all versions before 4.0.1
- Remediation
- Update to 4.0.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
- Weakness
- CWE-345
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-23
- Attack surface
- myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program on WPSec AttackSurface
- Fix released
- Published
Description
The myCRED plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity via the buyCRED Skrill gateway IPN handler in all versions up to, and including, 4.0.0. This is due to the md5sig signature and pay_to_email values only being verified when present in the request, and the amount, currency and payment status only being checked when supplied. This makes it possible for unauthenticated attackers to send forged IPN notifications that omit these fields and mark pending point purchases as paid without making any payment. Exploitation requires the Skrill payment gateway to be enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-1529/
- https://plugins.svn.wordpress.org/mycred/tags/4.0.1/
- https://wordpress.org/plugins/mycred/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS