Medium severity5.3NVD Advisory· Published Sep 25, 2024· Updated Jun 17, 2026

CVE-2024-8658

Description

The myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the mycred_update_database() function in all versions up to, and including, 2.7.3. This makes it possible for unauthenticated attackers to upgrade an out of date database.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Mycred/Mycred
cpe:2.3:a:mycred:mycred:*:*:*:*:*:wordpress:*:*
Range: <2.7.4
WordPress/Mycredllm-fuzzy
Range: <=2.7.3
Package: https://wordpress.org/plugins/mycred
saadiqbal/Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCredv5
Range: 0

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/changeset/3156989/mycred/trunk/includes/mycred-database-upgrade.phpnvdPatch
www.wordfence.com/threat-intel/vulnerabilities/id/20be9a37-9e9f-4791-a27c-e0db007be787nvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000