{
 "id": "WPSEC-2026-1529",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1529/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1529/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1529/index.md",
 "title": "myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 4.0.0 - Unauthenticated Insufficient Verification of Data Authenticity to Point Purchase Payment Bypass via Skrill IPN Handler",
 "description": "The myCRED plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity via the buyCRED Skrill gateway IPN handler in all versions up to, and including, 4.0.0. This is due to the md5sig signature and pay_to_email values only being verified when present in the request, and the amount, currency and payment status only being checked when supplied. This makes it possible for unauthenticated attackers to send forged IPN notifications that omit these fields and mark pending point purchases as paid without making any payment. Exploitation requires the Skrill payment gateway to be enabled.",
 "plugin": {
  "slug": "mycred",
  "name": "myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program",
  "full_name": "Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred",
  "wordpress_org": "https://wordpress.org/plugins/mycred/",
  "advisories_url": "https://wpsec.com/vuln/plugin/mycred/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/mycred"
 },
 "type": "AUTHBYPASS",
 "cwe": [
  "CWE-345"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.9,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.0.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.0.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.0.1",
 "remediation": "Update to 4.0.1 or later.",
 "fix_released": "2026-10-22T14:43:16+00:00",
 "published": "2026-10-23T14:43:26+00:00",
 "updated": "2026-10-23T07:09:17.400761+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1529/",
  "https://plugins.svn.wordpress.org/mycred/tags/4.0.1/",
  "https://wordpress.org/plugins/mycred/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/mycred",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-23"
 }
}