Description
The myCred WordPress plugin before 2.4.3.1 does not have any authorisation and CSRF checks in the mycred-tools-import-export AJAX action, allowing any authenticated users, such as subscribers, to call it and import mycred setup, thus creating badges, managing points or creating arbitrary posts.
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Unknown | myCred | unaffected |
|
No data.
No data available yet.
Remediation
No remediation available yet.
Tracking
Sign in to view the affected projects.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2022-15518 | The myCred WordPress plugin before 2.4.3.1 does not have any authorisation and CSRF checks in the mycred-tools-import-export AJAX action, allowing any authenticated users, such as subscribers, to call it and import mycred setup, thus creating badges, managing points or creating arbitrary posts. |
References
History
Fri, 17 Oct 2025 17:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Wpexperts
Wpexperts mycred |
|
| CPEs | cpe:2.3:a:wpexperts:mycred:*:*:*:*:*:wordpress:*:* | |
| Vendors & Products |
Mycred
Mycred mycred |
Wpexperts
Wpexperts mycred |
MITRE
Status: PUBLISHED
Assigner: WPScan
Published:
Updated: 2024-08-02T23:25:40.197Z
Reserved: 2022-01-25T00:00:00.000Z
Link: CVE-2022-0363
Vulnrichment
No data.
NVD
Status : Modified
Published: 2022-04-25T16:16:07.577
Modified: 2025-10-17T16:52:50.380
Link: CVE-2022-0363
Redhat
No data.
OpenCVE Enrichment
No data.