CVE-2026-15150: myCred < 3.2.5 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver Verification in buyCRED
The myCred WordPress plugin before 3.2.5 does not verify that the receiver of an incoming payment gateway notification matches the site's configured merchant account, allowing unauthenticated attackers to have arbitrary amounts of the site's in-site currency credited to an account by completing a payment for the expected amount to a gateway account they control rather than the site's.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
myCred WordPress pluginto a version that resolves this vulnerability.Fixed in 3.2.5 - Compensating control
Until upgraded, restrict/monitor access to the buyCRED payment notification handling so only legitimate gateway notification sources can reach it (e.g., restrict inbound requests to the notification endpoint from expected PayPal IP ranges).
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using the myCred WordPress plugin with a version earlier than 3.2.5 are affected. The issue is in the buyCRED payment flow handling of incoming gateway notifications.
What does an attacker need to exploit it?
An attacker does not need authentication or user interaction. They need to complete a payment for the expected amount, but can direct that payment to a gateway account they control instead of the merchant account configured by the site.
What is the impact of successful exploitation?
An attacker can cause arbitrary amounts of the site's in-site currency to be credited to an account. The provided information indicates integrity impact only, with no stated confidentiality or availability impact.
How can administrators remediate the issue?
Update myCred to version 3.2.5 or later. The affected versions are those before 3.2.5.