# myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 4.0.0 - Unauthenticated Authentication Bypass to Point Manipulation via Remote API

- **ID:** WPSEC-2026-1530
- **Plugin:** Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred (`mycred`), https://wordpress.org/plugins/mycred/
- **Affected versions:** all versions before 4.0.1
- **Fixed in:** 4.0.1 (Update to 4.0.1 or later.)
- **Severity:** Medium 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)
- **Weakness:** CWE-287
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-23)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/mycred
- **Fix released:** 2026-10-22
- **Published:** 2026-10-23
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1530/

## Description

The myCRED plugin for WordPress is vulnerable to Authentication Bypass via the Remote API in all versions up to, and including, 4.0.0. This is due to the plugin only rejecting a NULL API key and allowing the Remote API to be enabled with an empty key, which makes request tokens predictable. This makes it possible for unauthenticated attackers to forge Remote API requests and perform point operations such as adding or deducting points for users. Exploitation requires the Remote API to be enabled with an empty key configured.

## References

- https://wpsec.com/vuln/WPSEC-2026-1530/
- https://plugins.svn.wordpress.org/mycred/tags/4.0.1/
- https://wordpress.org/plugins/mycred/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1530/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.