# myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 4.0.2 - Authenticated (Subscriber+) Insufficient Verification of Data Authenticity to Point Purchase Payment Bypass via NETbilling Callback

- **ID:** WPSEC-2026-1832
- **Plugin:** Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred (`mycred`), https://wordpress.org/plugins/mycred/
- **Affected versions:** all versions before 4.0.3
- **Fixed in:** 4.0.3 (Update to 4.0.3 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
- **Weakness:** CWE-345
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-28)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/mycred
- **Fix released:** 2026-10-27
- **Published:** 2026-10-28
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1832/

## Description

The myCred plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity via the buyCRED NETbilling gateway callback in all versions up to, and including, 4.0.2. This is due to the callback being validated only with the security hash that the plugin places in the buyer's own checkout form (an MD5 of the crypto key, cost and item description), and to the callback not requiring a successful status code or a unique transaction ID. This makes it possible for authenticated attackers, with Subscriber-level access and above, to start a point purchase, send that hash back to the callback with their pending payment ID, and have the points credited to their account without paying. Exploitation requires the NETbilling gateway to be enabled.

## References

- https://wpsec.com/vuln/WPSEC-2026-1832/
- https://plugins.svn.wordpress.org/mycred/tags/4.0.3/
- https://wordpress.org/plugins/mycred/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1832/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.