Based on the description, the vulnerability arises from missing authorization checks in the myCred WordPress plugin. The flaw allows an attacker to bypass intended access controls, enabling operations that should be restricted to privileged users. Exploitation could lead to unauthorized viewing or manipulation of user credentials, points, or balances, directly compromising user data integrity and confidentiality.

Affected systems are WordPress sites that use the myCred plugin version 4.0.2 or earlier. The vulnerability applies to all releases of myCred from its introduction through 4.0.2, meaning any site that has not activated a later version is at risk. The flaw exists regardless of additional WordPress configuration, so all installations of the plugin in that version range must be examined.

The CVSS score of 4.3 reflects a moderate severity, and no EPSS figure is currently available. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation has been reported to date. Based on the description, it is inferred that attackers could exploit this vulnerability through ordinary web requests to the plugin’s administrative endpoints, using any user credentials that have been improperly granted. The likely attack vector is web requests. The lack of an EPSS score and KEV listing indicates that exploitation probability is likely low, but the impact of incorrect access control warrants immediate remediation.