CVE-2026-122668mediumCWE-862

CVE-2026-122668: medium-severity vulnerability in myCred

WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability

Published

Follow this CVE+ Monitor myCred

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

10Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.3
Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected products
myCred · myCred
Related CVEs — myCred

In the same product, most dangerous first.

CVE-2026-40794MEDIUMWordPress myCred plugin <= 3.0.3 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-97073MEDIUMWordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-115962MEDIUMWordPress myCred plugin <= 4.0.1 - Bypass Vulnerability vulnerabilityEPSS 0.3%CVE-2023-35096MEDIUMWordPress myCred Plugin <= 2.5 is vulnerable to Cross Site Request Forgery (CSRF)EPSS 0.2%CVE-2026-114698MEDIUMWordPress myCred plugin <= 4.0.0-beta.1 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.2%CVE-2026-103077MEDIUMWordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerabilityEPSS 0.2%