The vulnerability lies in missing authorization checks within the myCred WordPress plugin, allowing an attacker to execute functions that should be restricted to privileged users. Exploiting the incorrectly configured access control can result in unauthorized modification of user balances, manipulation of gift card data, or other privileged operations. The weakness is categorized as CWE-862, a Broken Access Control flaw.

WordPress sites that use the myCred plugin version 4.0.2 or earlier are affected. This includes all installations of the plugin from its introduction through version 4.0.2. The problem exists in the plugin code that manages user credits, points, or rewards, and affects any user who can reach the plugin’s administrative or API endpoints.

The CVSS score of 4.3 indicates a moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via web requests to the plugin’s privileged endpoints – a path inferred from the nature of access‑control checks and the plugin’s exposed functions. Successful exploitation would allow an attacker to bypass role restrictions and perform actions normally limited to higher‑privileged users.