Missing authorization in the WordPress myCred plugin up to version 4.0.2 allows attackers to bypass intended security settings and perform actions or view data that should be restricted. The weakness is a classic Broken Access Control flaw (CWE-862) that can expose sensitive user information or enable unauthorized modifications to plugin data.

The vulnerability impacts the WordPress myCred plugin from its earliest releases through 4.0.2. It affects any WordPress site that has this plugin installed and has not applied the latest update.

The CVSS score of 4.3 indicates moderate risk. The EPSS is not available, suggesting no documented exploitation frequency. The issue is not listed in CISA’s KEV catalog. Likely exploitation would involve a web request to a plugin endpoint that does not enforce proper authorization. The required input is a site running an affected plugin version; no special privileges are needed beyond the ability to craft a request.