CVE-2026-24951

Vulnerability

Overview

The myCred plugin for WordPress, versions 2.9.7.3 and earlier, contains a missing authorization vulnerability. The issue stems from incorrect configuration of access control security levels, which fails to properly verify user privileges before allowing certain actions [1].

Exploitation

Method

To exploit this vulnerability, an attacker needs only to be an unauthenticated or low-privileged user. The broken access control flaw occurs because the plugin does not enforce proper authorization checks in specific functions. This allows a lower-privileged user to perform actions that should require higher privileges, such as administrative operations [1].

Impact

Successful exploitation could allow an attacker to execute unauthorized administrative actions, potentially leading to data manipulation or other security compromises within affected WordPress sites. While the severity is considered medium (CVSS 4.3), the vulnerability is noted to be used in mass-exploit campaigns targeting thousands of websites [1].

Mitigation

The issue has been addressed in version 2.9.7.4 of myCred. Users are strongly advised to update immediately. For those unable to update, consulting with hosting providers or web developers is recommended. Patchstack users can enable auto-updates for vulnerable plugins [1].