myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 4.0.2 - Authenticated (Subscriber+) Insufficient Verification of Data Authenticity to Point Purchase Payment Bypass via NETbilling Callback
- ID
- WPSEC-2026-1832
- Plugin
- Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred (mycred)
- Affected
- all versions before 4.0.3
- Remediation
- Update to 4.0.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- Weakness
- CWE-345
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-28
- Attack surface
- myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program on WPSec AttackSurface
- Fix released
- Published
Description
The myCred plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity via the buyCRED NETbilling gateway callback in all versions up to, and including, 4.0.2. This is due to the callback being validated only with the security hash that the plugin places in the buyer's own checkout form (an MD5 of the crypto key, cost and item description), and to the callback not requiring a successful status code or a unique transaction ID. This makes it possible for authenticated attackers, with Subscriber-level access and above, to start a point purchase, send that hash back to the callback with their pending payment ID, and have the points credited to their account without paying. Exploitation requires the NETbilling gateway to be enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-1832/
- https://plugins.svn.wordpress.org/mycred/tags/4.0.3/
- https://wordpress.org/plugins/mycred/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS