CVE-2026-15150mediumCWE-345

CVE-2026-15150: fallo de gravedad media en myCred

myCred < 3.2.5 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver Verification in buyCRED

Publicada el

Seguir esta CVE+ Monitorear myCred

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

33Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendcvss 5.3epss 0.2%
The myCred WordPress plugin before 3.2.5 does not verify that the receiver of an incoming payment gateway notification matches the site's configured merchant account, allowing unauthenticated attackers to have arbitrary amounts of the site's in-site currency credited to an account by completing a payment for the expected amount to a gateway account they control rather than the site's.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Productos afectados
Unknown · myCred
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — myCred

En el mismo producto, de las más peligrosas a las menos.

CVE-2022-0287—Mycred < 2.4.4.1 - Subscriber+ User E-mail Addresses DisclosureEPSS 0.8%CVE-2022-1092—myCred < 2.4.4 - Subscriber+ Import/Export to Email Address DisclosureEPSS 0.4%CVE-2022-0363—myCred < 2.4.4 - Subscriber+ Arbitrary Post CreationEPSS 0.3%