The vulnerability is a Time‑of‑Check Time‑of‑Use race condition in the Saad Iqbal myCred WordPress plugin, classified as CWE‑367. It can allow an attacker to create or modify content or data inconsistently, potentially leading to unauthorized actions. The flaw carries a CVSS score of 5.3, indicating a moderate impact.

All installations of the myCred WordPress plugin from the earliest releases up through version 2.9.4.3 are potentially affected. Users running any version equal to or older than 2.9.4.3 are at risk.

The EPSS score is <1 %, indicating a low likelihood of exploitation at present, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a precise timing sequence, likely involving concurrent or repeated requests through the web interface, which limits practicality. No publicly available exploit has been reported, and the moderate CVSS score suggests potential compromise of data integrity but unlikely full system compromise.