CVE-2026-15150: myCred WordPress Plugin Auth Bypass Flaw

CVE-2026-15150 is an authentication bypass vulnerability in the myCred WordPress plugin that allows attackers to credit arbitrary amounts of in-site currency by redirecting payments to their own accounts. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-15150 Overview

CVE-2026-15150 affects the myCred WordPress plugin in versions before 3.2.5. The plugin fails to verify that the receiver of an incoming payment gateway notification matches the site's configured merchant account. Unauthenticated attackers can credit arbitrary amounts of the site's in-site currency to an account by completing a payment for the expected amount to a gateway account they control. The flaw maps to insufficient verification of data authenticity [CWE-345].

Critical Impact
Unauthenticated attackers can fraudulently inflate their in-site currency balance by redirecting payment confirmations through attacker-controlled gateway accounts.

Affected Products

myCred WordPress plugin versions prior to 3.2.5
WordPress sites using myCred payment gateway integrations
Sites accepting external gateway payment notifications through myCred

Discovery Timeline

2026-08-21 - CVE-2026-15150 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-15150

Vulnerability Analysis

The myCred plugin processes incoming payment gateway notifications to credit user accounts with in-site currency. The plugin validates that a payment succeeded and that the amount matches the expected value. It does not, however, validate that the payment was received by the merchant account configured on the WordPress site.

An attacker who initiates a purchase flow can substitute their own gateway account as the receiver. When the gateway sends a success notification back to the site, myCred accepts it and credits the attacker's user account. The site's actual merchant account never receives funds.

Root Cause

The root cause is insufficient verification of data authenticity in the payment notification handler. The plugin trusts the gateway's confirmation of a completed payment without cross-checking the recipient merchant identifier against the site's configured account. This is a business logic flaw combined with missing origin validation on webhook data.

Attack Vector

The attack is remotely exploitable over the network with low complexity and no authentication or user interaction required. An attacker initiates a payment flow on the target site, redirects the payment to a gateway account they control, completes the payment for the requested amount, and lets the gateway callback trigger crediting of in-site currency. The attacker retains funds paid to their own gateway account while receiving site currency worth the paid amount. Refer to the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-15150

Indicators of Compromise

Unexpected increases in user in-site currency balances without corresponding entries in the merchant account's transaction ledger
Payment gateway webhook requests referencing merchant or receiver identifiers that do not match the site's configured account
Successful myCred credit events originating from IP addresses associated with anonymization services
Multiple new user registrations followed shortly by payment-gateway credit events

Detection Strategies

Reconcile myCred point-credit events against confirmed deposits in the merchant gateway account on a scheduled basis
Inspect webhook payloads for the receiver or merchant field and alert when it does not equal the configured site account
Monitor WordPress database tables used by myCred for anomalous credit transactions tied to newly created accounts

Monitoring Recommendations

Log all inbound payment gateway callbacks with full payload contents to a centralized log store for post-hoc analysis
Alert on any myCred balance change exceeding a defined threshold within a short time window
Enable WordPress audit logging for plugin actions and user balance modifications

How to Mitigate CVE-2026-15150

Immediate Actions Required

Upgrade the myCred plugin to version 3.2.5 or later on all affected WordPress sites
Audit user balances and transaction history for fraudulent credits granted before patching
Reconcile all recent gateway callbacks against the configured merchant account and reverse fraudulent balances

Patch Information

The vendor addressed the flaw in myCred version 3.2.5. The fix introduces verification that the receiver identifier in gateway notifications matches the site's configured merchant account before crediting in-site currency. Administrators should update through the WordPress plugin manager or by deploying the updated plugin package. See the WPScan Vulnerability Report for advisory references.

Workarounds

Temporarily disable myCred payment gateway integrations until the plugin is updated to 3.2.5
Restrict payment gateway webhook endpoints to allow-listed source IP ranges published by the payment provider
Manually review and approve gateway-triggered balance credits until the patch is applied

bash

# Update myCred via WP-CLI to the patched version
wp plugin update mycred --version=3.2.5
wp plugin get mycred --field=version