{
 "id": "WPSEC-2026-1530",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1530/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1530/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1530/index.md",
 "title": "myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 4.0.0 - Unauthenticated Authentication Bypass to Point Manipulation via Remote API",
 "description": "The myCRED plugin for WordPress is vulnerable to Authentication Bypass via the Remote API in all versions up to, and including, 4.0.0. This is due to the plugin only rejecting a NULL API key and allowing the Remote API to be enabled with an empty key, which makes request tokens predictable. This makes it possible for unauthenticated attackers to forge Remote API requests and perform point operations such as adding or deducting points for users. Exploitation requires the Remote API to be enabled with an empty key configured.",
 "plugin": {
  "slug": "mycred",
  "name": "myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program",
  "full_name": "Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred",
  "wordpress_org": "https://wordpress.org/plugins/mycred/",
  "advisories_url": "https://wpsec.com/vuln/plugin/mycred/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/mycred"
 },
 "type": "AUTHBYPASS",
 "cwe": [
  "CWE-287"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.9,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.0.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.0.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.0.1",
 "remediation": "Update to 4.0.1 or later.",
 "fix_released": "2026-10-22T14:43:16+00:00",
 "published": "2026-10-23T14:43:26+00:00",
 "updated": "2026-10-23T07:09:17.400761+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1530/",
  "https://plugins.svn.wordpress.org/mycred/tags/4.0.1/",
  "https://wordpress.org/plugins/mycred/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/mycred",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-23"
 }
}