CVE-2026-97073: WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress myCred pluginto a version that resolves this vulnerability.Fixed in 4.0.3
Event History
Frequently Asked Questions
Who can exploit this issue?
The published vector indicates it can be exploited remotely over the network without authentication or user interaction. The impact is limited to confidentiality; integrity and availability are not affected according to the provided severity vector.
Which myCred versions are affected?
The issue affects myCred versions through 4.0.2. No fixed version is provided in the available data.
What should teams do if they cannot confirm a patched version?
Because no remediation or fixed release is identified in the provided data, teams should treat installations at version 4.0.2 or earlier as potentially affected and review access-control configuration and exposed plugin functionality.