The myCred plugin for WordPress suffers from a missing authorization flaw, allowing users to invoke functions that should be protected by access control lists. The flaw does not provide direct code execution or remote escalation but enables the exploitation of privileged operations that were intended to be restricted to certain roles. Such unauthorized interactions can lead to manipulation of points, changes to user privileges, or exploitation of sensitive configuration data, compromising the integrity and confidentiality of the site.

The vulnerability affects the Saad Iqbal myCred plugin across all versions from the earliest released through version 2.9.4.2. Any installation of the plugin on a WordPress site that is running one of these affected versions is susceptible.

The CVSS score of 5.3 reflects a moderate severity, while the EPSS score of less than 1% indicates a low probability of exploitation in the near term. The vulnerability is not currently listed in the CISA KEV catalog. Attackers would likely leverage standard HTTP requests to plugin endpoints that lack proper ACL checks, possibly involving authenticated users or, if the plugin does not enforce authentication, even unauthenticated users. No additional privileges are required beyond the ability to send HTTP requests to the affected plugin.