The WordPress myCred plugin suffers from an authentication bypass that allows an attacker to spoof another user's identity. This weakness is a Bypass of Authentication (CWE-290). This vulnerability lets an unauthorized user assume the credentials of any account on the site, potentially accessing content and functions that require authentication.

The issue affects the myCred plugin for WordPress sites, from any version prior to 4.0.1 through 4.0.1. WordPress installations with the plugin in use without updating to a later version are vulnerable.

The CVSS score of 4.3 denotes moderate severity. No EPSS score is available and the flaw is not listed in CISA's KEV catalog. The bypass can be triggered by external users who can send crafted requests to the plugin's endpoints, which are typically exposed over the public web; based on the description, this is inferred as the likely attack vector. The absence of access controls on the vulnerable code path makes exploitation likely for a remote attacker.