CVE-2026-124274: WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability

Q: Which installations are affected?

The issue affects myCred versions through 4.0.2. The available information does not identify a lower affected version boundary.

Q: What access or conditions does an attacker need to exploit this vulnerability?

The available data identifies incorrectly configured access-control security levels as the issue, but does not specify the attacker privileges, endpoint, or configuration conditions required for exploitation.

Q: Is a default myCred configuration affected?

The available information does not state whether the vulnerable access-control condition exists in a default configuration.

Published Nov 7, 2026

Updated

Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress myCred plugin to a version that resolves this vulnerability.
Fixed in 4.0.3

Event History

Nov 7, 2026

CVE Published

via MITRE·08:50 AM

Data Sourced

via MITRE·08:50 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·09:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations are affected?

The issue affects myCred versions through 4.0.2. The available information does not identify a lower affected version boundary.

What access or conditions does an attacker need to exploit this vulnerability?

The available data identifies incorrectly configured access-control security levels as the issue, but does not specify the attacker privileges, endpoint, or configuration conditions required for exploitation.

Is a default myCred configuration affected?

The available information does not state whether the vulnerable access-control condition exists in a default configuration.

CVE-2026-124274: WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability

Remediation

Event History

Frequently Asked Questions

Which installations are affected?

What access or conditions does an attacker need to exploit this vulnerability?

Is a default myCred configuration affected?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

What access or conditions does an attacker need to exploit this vulnerability?

Is a default myCred configuration affected?