CVE-2024-43214: Wpexperts myCred Auth Bypass Vulnerability

CVE-2024-43214 Overview

CVE-2024-43214 is a missing authorization vulnerability affecting the myCred plugin for WordPress. The flaw exists in all versions up to and including 2.7.2. myCred is a points, rewards, and gamification plugin distributed by wpexperts and maintained by Saad Iqbal.

The vulnerability allows unauthenticated attackers to access sensitive data exposed by plugin endpoints that fail to enforce proper authorization checks. Exploitation requires no user interaction and no privileges. The issue is classified under [CWE-862: Missing Authorization].

Critical Impact
Unauthenticated attackers can reach protected functionality over the network and retrieve sensitive information from WordPress sites running vulnerable myCred versions.

Affected Products

myCred plugin for WordPress versions up to and including 2.7.2
WordPress sites using myCred for points, rewards, or gamification features
Deployments distributed by wpexperts / Saad Iqbal

Discovery Timeline

2024-08-26 - CVE-2024-43214 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-43214

Vulnerability Analysis

The vulnerability stems from an authorization check that is missing from one or more myCred plugin endpoints. When a request reaches the affected functionality, the plugin does not verify whether the caller is entitled to receive the response. This gap allows unauthenticated network requests to return data that should be restricted to privileged users.

The issue is scoped to confidentiality. Attackers can read sensitive information exposed by the vulnerable endpoints, but the flaw does not permit modification of data or disruption of site availability. Patchstack categorizes the underlying weakness as a sensitive data exposure issue caused by broken access control.

Because myCred is widely used to track user points, rewards, ranks, and transaction history, exposed data may include user-level gamification records and related metadata. Site operators should treat any information handled by the plugin as potentially reachable prior to patching.

Root Cause

The root cause is a missing authorization control on plugin functionality prior to version 2.7.3. The affected code path does not call WordPress capability checks such as current_user_can() or validate a nonce before returning data. Any unauthenticated HTTP request that reaches the endpoint receives a response.

Attack Vector

An attacker sends a crafted HTTP request to the vulnerable myCred endpoint on a targeted WordPress site. The request requires no authentication, no session, and no user interaction. The server processes the request and returns sensitive plugin data in the response body. Full technical details are available in the Patchstack Vulnerability Report.

Detection Methods for CVE-2024-43214

Indicators of Compromise

Unauthenticated HTTP requests to myCred plugin endpoints under /wp-admin/admin-ajax.php or /wp-json/mycred/ returning non-empty JSON responses
Access log entries showing repeated GET or POST requests to myCred action handlers from a single external IP address
WordPress mycred plugin reporting version 2.7.2 or earlier in the admin plugins list

Detection Strategies

Inventory all WordPress installations and identify sites running myCred versions at or below 2.7.2
Review web server access logs for anomalous request volume targeting myCred AJAX actions or REST routes from unauthenticated sources
Correlate outbound data volume from the WordPress host with request patterns matching myCred endpoints to identify potential scraping

Monitoring Recommendations

Enable WordPress security plugin logging to capture requests reaching myCred handlers along with the authentication state of the caller
Forward web server and WordPress audit logs to a centralized logging platform for retention and query
Alert on burst patterns where a single client issues many sequential requests to myCred endpoints within a short window

How to Mitigate CVE-2024-43214

Immediate Actions Required

Update the myCred plugin to a version above 2.7.2 on every affected WordPress site
Audit web server access logs for prior requests to myCred endpoints from unauthenticated sources and assess exposure
Restrict administrative and REST API access to trusted networks where operationally feasible

Patch Information

The vendor addressed the vulnerability in a version released after 2.7.2. Site administrators should upgrade through the WordPress plugin manager or by replacing plugin files with the latest release. Refer to the Patchstack Vulnerability Report for advisory details and remediation guidance.

Workarounds

Temporarily deactivate the myCred plugin on sites that cannot be patched immediately
Apply a web application firewall rule to block unauthenticated requests to known myCred AJAX and REST endpoints
Limit access to /wp-admin/admin-ajax.php and /wp-json/ paths by IP allowlist where the site does not require public API access

bash

# Example WAF rule concept for blocking unauthenticated access to myCred REST routes
# Adapt to your WAF syntax (ModSecurity, Cloudflare, AWS WAF, etc.)
SecRule REQUEST_URI "@rx /wp-json/mycred/" \
    "id:1004321,phase:1,deny,status:403,\
    msg:'Block unauthenticated access to myCred REST endpoint (CVE-2024-43214)',\
    chain"
    SecRule &REQUEST_HEADERS:Cookie "@eq 0"