Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
CVE-2025-12362: myCred WordPress Plugin Allows Unauthorized Access to User Points
CVE-2025-12362 · published 10 months ago
Summary
The myCred plugin for WordPress is not properly verifying user authorization, allowing attackers to approve withdrawal requests, modify user points, and manipulate payment processing. This affects users of the plugin in versions 2.9.7 and earlier. To fix this, update to the latest version of the plugin.
Original advisory text
The myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.9.7. This ...
The myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.9.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to approve withdrawal requests, modify user point balances, and manipulate the payment processing system via the cashcred_pay_now AJAX action.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-862Missing Authorization
Timeline
Published13 Dec 2025
Updated3 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-12362 · NVD
Track software like this
Free during beta