CVE-2026-125811: WordPress myCred plugin <= 4.0.2 - SQL Injection vulnerability
Published Nov 13, 2026
·Updated
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in myCred myCred mycred allows Blind SQL Injection.This issue affects myCred: from n/a through 4.0.2.
Affected Software
1 affected component
Mycred myCred<=4.0.2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress myCred pluginto a version that resolves this vulnerability.Fixed in 4.0.3
Event History
Nov 13, 2026
CVE Published
via MITRE·02:42 PM
Data Sourced
via MITRE·02:42 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·03:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What access does an attacker need to exploit this issue?
The attack vector is network-based and has low attack complexity. An attacker needs low-level privileges, but no user interaction is required.
2
What impact does the severity assessment indicate?
The assessment indicates high confidentiality impact, no integrity impact, and low availability impact. It also indicates that the vulnerable component can affect resources outside its security scope.