CVE-2026-122668: WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability

Q: Does the record identify a version that fixes the issue?

No fixed version is identified in the provided data. The affected range is stated as myCred through version 4.0.2.

Q: What attacker prerequisites or exposed configurations are documented?

The provided data does not state whether authentication, a particular role, or a specific site configuration is required. It characterizes the issue as incorrect configuration of access-control security levels.

Published Nov 7, 2026

Updated

Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress myCred plugin to a version that resolves this vulnerability.
Fixed in 4.0.3

Event History

Nov 7, 2026

CVE Published

via MITRE·09:14 AM

Data Sourced

via MITRE·09:14 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Does the record identify a version that fixes the issue?

No fixed version is identified in the provided data. The affected range is stated as myCred through version 4.0.2.

What attacker prerequisites or exposed configurations are documented?

The provided data does not state whether authentication, a particular role, or a specific site configuration is required. It characterizes the issue as incorrect configuration of access-control security levels.

CVE-2026-122668: WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability

Remediation

Event History

Frequently Asked Questions

Does the record identify a version that fixes the issue?

What attacker prerequisites or exposed configurations are documented?

Company

Resources

Contact

Frequently Asked Questions

Does the record identify a version that fixes the issue?

What attacker prerequisites or exposed configurations are documented?