The vulnerability is a missing authorization check in the myCred plugin for WordPress. It allows an attacker to perform actions normally restricted to privileged users, such as modifying user credit balances or accessing private information. The flaw is identified as CWE-862 and could result in unauthorized data manipulation or exposure, impacting confidentiality and integrity of user data.

The affected product is the myCred WordPress plugin, versions up to and including 4.0.2. Any WordPress installation that has the plugin installed without an update is vulnerable. The vendor states the issue affects all releases from the first version through 4.0.2, so all those installations remain at risk until updated.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves unauthenticated or low‑privilege HTTP requests to plugin endpoints, which can be performed remotely by anyone with access to the site. No explicit prerequisites are listed, so an attacker does not need prior credentials to exploit the flaw.