Vulnerabilities / myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program / WPSEC-2026-1530
myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 4.0.0 - Unauthenticated Authentication Bypass to Point Manipulation via Remote API
Medium 5.9
CWE-287Fixed in 4.0.1
- ID
- WPSEC-2026-1530
- Plugin
- Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred (mycred)
- Affected
- all versions before 4.0.1
- Remediation
- Update to 4.0.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
- Weakness
- CWE-287
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-23
- Attack surface
- myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program on WPSec AttackSurface
- Fix released
- Published
Description
The myCRED plugin for WordPress is vulnerable to Authentication Bypass via the Remote API in all versions up to, and including, 4.0.0. This is due to the plugin only rejecting a NULL API key and allowing the Remote API to be enabled with an empty key, which makes request tokens predictable. This makes it possible for unauthenticated attackers to forge Remote API requests and perform point operations such as adding or deducting points for users. Exploitation requires the Remote API to be enabled with an empty key configured.
References
- https://wpsec.com/vuln/WPSEC-2026-1530/
- https://plugins.svn.wordpress.org/mycred/tags/4.0.1/
- https://wordpress.org/plugins/mycred/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS