WordPress myCred plugin versions up to 4.0.0-beta.1 contain an Authorization Bypass Through User‑Controlled Key flaw that enables an attacker to exploit incorrectly configured access control levels. The vulnerability allows a user with a crafted key to access or modify protected resources normally restricted by the plugin’s permissions, potentially compromising user account data and content. The weakness corresponds to CWE‑639, Insecure Direct Object Reference.

Any installation of the WordPress myCred plugin from the earliest released version through 4.0.0-beta.1 is affected. The plugin is distributed under the myCred vendor identifier and is commonly used within WordPress themes and custom sites that rely on the myCred points system.

The CVSS score of 5.4 places this flaw in the moderate severity range. No EPSS value is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, which indicates there is no publicly documented exploitation yet. The attack vector is inferred to be remote, as the flaw is accessed via web requests to the plugin’s endpoints and requires no local privileges. An attacker with network access to the affected WordPress site could potentially craft requests that bypass the plugin’s access checks and read or alter protected data.