The myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the mycred_update_database() function in all versions up to, and including, 2.7.3. This makes it possible for unauthenticated attackers to upgrade an out of date database.
Metrics
Affected Vendors & Products
References
History
Wed, 02 Oct 2024 19:00:00 +0000
Type | Values Removed | Values Added |
---|---|---|
CPEs | cpe:2.3:a:mycred:mycred:*:*:*:*:*:wordpress:*:* |
Wed, 25 Sep 2024 14:30:00 +0000
Type | Values Removed | Values Added |
---|---|---|
First Time appeared |
Mycred
Mycred mycred |
|
CPEs | cpe:2.3:a:mycred:mycred:*:*:*:*:*:*:*:* | |
Vendors & Products |
Mycred
Mycred mycred |
|
Metrics |
ssvc
|
Wed, 25 Sep 2024 05:45:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Description | The myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the mycred_update_database() function in all versions up to, and including, 2.7.3. This makes it possible for unauthenticated attackers to upgrade an out of date database. | |
Title | myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification <= 2.7.3 - Missing Authorization to Unauthenticated Database Upgrade | |
Weaknesses | CWE-862 | |
References |
| |
Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: Wordfence
Published: 2024-09-25T05:32:09.806Z
Updated: 2024-09-25T13:45:32.704Z
Reserved: 2024-09-10T14:27:42.568Z
Link: CVE-2024-8658
Vulnrichment
Updated: 2024-09-25T13:45:07.724Z
NVD
Status : Analyzed
Published: 2024-09-25T06:15:05.797
Modified: 2024-10-02T18:36:04.033
Link: CVE-2024-8658
Redhat
No data.