CVE-2026-123465: WordPress myCred plugin <= 4.0.2 - Sensitive Data Exposure vulnerability

Q: Which deployments are affected?

The affected product is the WordPress myCred plugin. Versions through 4.0.2 are affected; the available data does not identify a fixed version.

Q: Does exploitation require authentication or user interaction?

No. The supplied CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.

Q: What is the likely impact of successful exploitation?

The vulnerability can expose embedded sensitive data or sensitive system information. The supplied scoring indicates high confidentiality impact, with no indicated integrity or availability impact.

Published Nov 9, 2026

Updated

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in myCred myCred mycred allows Retrieve Embedded Sensitive Data.This issue affects myCred: from n/a through 4.0.2.

Affected Software

1 affected component

Mycred myCred<=4.0.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress myCred plugin to a version that resolves this vulnerability.
Fixed in 4.0.3

Event History

Nov 9, 2026

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·10:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

The affected product is the WordPress myCred plugin. Versions through 4.0.2 are affected; the available data does not identify a fixed version.

Does exploitation require authentication or user interaction?

No. The supplied CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.

What is the likely impact of successful exploitation?

The vulnerability can expose embedded sensitive data or sensitive system information. The supplied scoring indicates high confidentiality impact, with no indicated integrity or availability impact.

CVE-2026-123465: WordPress myCred plugin <= 4.0.2 - Sensitive Data Exposure vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

Does exploitation require authentication or user interaction?

What is the likely impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

Does exploitation require authentication or user interaction?

What is the likely impact of successful exploitation?