CVE-2024-8658: myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification <= 2.7.3 - Missing Authorization to Unauthenticated Database Upgrade
The myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the mycredupdatedatabase() function in all versions up to, and including, 2.7.3. This makes it possible for unauthenticated attackers to upgrade an out of date database.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-8658?
CVE-2024-8658 is classified as a high severity vulnerability due to its potential for unauthorized data modification.
How do I fix CVE-2024-8658?
To fix CVE-2024-8658, update the myCred plugin to version 2.7.4 or later.
Who is affected by CVE-2024-8658?
CVE-2024-8658 affects users of the myCred plugin version prior to 2.7.4 on WordPress and WooCommerce.
What type of vulnerability is CVE-2024-8658?
CVE-2024-8658 is a vulnerability related to unauthorized modification of data due to a missing capability check.
Is CVE-2024-8658 being actively exploited?
There is currently no public information indicating that CVE-2024-8658 is being actively exploited in the wild.