{
 "id": "WPSEC-2026-1832",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1832/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1832/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1832/index.md",
 "title": "myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 4.0.2 - Authenticated (Subscriber+) Insufficient Verification of Data Authenticity to Point Purchase Payment Bypass via NETbilling Callback",
 "description": "The myCred plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity via the buyCRED NETbilling gateway callback in all versions up to, and including, 4.0.2. This is due to the callback being validated only with the security hash that the plugin places in the buyer's own checkout form (an MD5 of the crypto key, cost and item description), and to the callback not requiring a successful status code or a unique transaction ID. This makes it possible for authenticated attackers, with Subscriber-level access and above, to start a point purchase, send that hash back to the callback with their pending payment ID, and have the points credited to their account without paying. Exploitation requires the NETbilling gateway to be enabled.",
 "plugin": {
  "slug": "mycred",
  "name": "myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program",
  "full_name": "Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred",
  "wordpress_org": "https://wordpress.org/plugins/mycred/",
  "advisories_url": "https://wpsec.com/vuln/plugin/mycred/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/mycred"
 },
 "type": "AUTHBYPASS",
 "cwe": [
  "CWE-345"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.0.3",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.0.3"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.0.3",
 "remediation": "Update to 4.0.3 or later.",
 "fix_released": "2026-10-27T10:38:47+00:00",
 "published": "2026-10-28T10:46:01+00:00",
 "updated": "2026-10-28T09:11:34.212379+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1832/",
  "https://plugins.svn.wordpress.org/mycred/tags/4.0.3/",
  "https://wordpress.org/plugins/mycred/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/mycred",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-28"
 }
}