CVE-2026-97073

CVE-2026-97073 · WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.

CVSS 5.3 · Medium · EPSS 0.3% · Fix available

Published: 2026-10-29T14:39:40.470Z
Updated: 2026-10-29T17:18:39.592Z

Affected products and versions

mycred
Versions
- ≥ 0, ≤ 4.0.2: Affected; ≥ 4.0.3: Not affected (custom)
Update to 4.0.3

Original sources

https://patchstack.com/database/wordpress/plugin/mycred/vulnerability/wordpress-mycred-plugin-4-0-2-broken-access-control-vulnerability?_s_id=cve
https://nvd.nist.gov/vuln/detail/CVE-2026-97073

Check your server →