CVE-2026-114698: WordPress myCred plugin <= 4.0.0-beta.1 - Insecure Direct Object References (IDOR) vulnerability
Published Oct 22, 2026
·Updated
Authorization Bypass Through User-Controlled Key vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.0-beta.1.
Affected Software
1 affected component
Mycred myCred<=4.0.0-beta.1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress myCred pluginto a version that resolves this vulnerability.Fixed in 4.0.0
Event History
Oct 22, 2026
CVE Published
via MITRE·07:31 AM
Data Sourced
via MITRE·07:31 AM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The vulnerability requires low-level privileges. It is remotely exploitable and does not require user interaction.
2
What is the potential impact if exploitation succeeds?
Successful exploitation can alter integrity and affect availability. The provided data does not indicate any confidentiality impact.
3
Which myCred versions are affected?
The issue affects myCred versions through 4.0.0-beta.1. The earliest affected version is not specified.