The myCred WordPress plugin, in all releases up through 4.0.2, contains a sensitive information disclosure flaw that permits an attacker to retrieve embedded sensitive data from the environment. Classified as CWE‑497, the vulnerability can lead to the unauthorized exposure of confidential information if exploited.

The affected product is the myCred WordPress plugin (myCred:myCred). All versions from the earliest releases through 4.0.2 are impacted; the issue was corrected in version 4.0.3 and later.

With a CVSS score of 7.5 the vulnerability is considered high severity, though the EPSS score is not provided and it is not listed in the CISA KEV catalog. The official description does not specify the attack vector, so the exact exploit path remains uncertain. Nevertheless, the flaw grants an attacker a means to access sensitive data through the plugin, potentially requiring only local or authenticated access to the WordPress site.