CVE-2026-115962: WordPress myCred plugin <= 4.0.1 - Bypass Vulnerability vulnerability
Published Oct 29, 2026
·Updated
Authentication Bypass by Spoofing vulnerability in myCred myCred mycred allows Identity Spoofing.This issue affects myCred: from n/a through 4.0.1.
Affected Software
1 affected component
Mycred myCred<=4.0.1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress myCred pluginto a version that resolves this vulnerability.Fixed in 4.0.2
Event History
Oct 29, 2026
CVE Published
via MITRE·11:00 AM
Data Sourced
via MITRE·11:00 AM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The vulnerability requires low-level privileges (PR:L). It is remotely reachable and does not require user interaction.
2
What security impact is indicated?
The reported impact is limited to integrity (I:L). No confidentiality or availability impact is indicated by the provided vector.
3
Which versions should be considered affected?
myCred versions through 4.0.1 are affected. The earliest affected version is not specified.