CVE-2026-40794: myCred Auth Bypass Vulnerability

CVE-2026-40794 Overview

CVE-2026-40794 is a broken access control vulnerability affecting the myCred WordPress plugin in versions up to and including 3.0.3. The flaw allows authenticated users holding the low-privilege Subscriber role to perform actions reserved for higher-privileged accounts. The weakness is classified under CWE-862: Missing Authorization. Because myCred manages points, rewards, and gamification data on WordPress sites, abuse of this flaw can compromise the integrity of user balances and plugin-managed records.

Critical Impact
An authenticated Subscriber can modify integrity-sensitive plugin data without proper authorization, bypassing intended role-based restrictions.

Affected Products

myCred WordPress plugin versions <= 3.0.3
WordPress sites with Subscriber-level registration enabled and myCred installed
Sites relying on myCred for points, rewards, or loyalty workflows

Discovery Timeline

2026-06-15 - CVE-2026-40794 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-40794

Vulnerability Analysis

The vulnerability stems from missing authorization checks within the myCred plugin codebase. One or more handlers exposed to authenticated requests fail to verify that the calling user holds the required capability before executing privileged operations. As a result, any logged-in account, including the lowest-privilege Subscriber role, can invoke functionality intended for administrators or other elevated roles.

The impact is concentrated on data integrity. An attacker with Subscriber access can manipulate plugin-managed records such as point balances, transaction logs, or configuration values. Confidentiality and availability are not directly affected, but tampered point or reward data can cascade into business logic abuse on sites that tie myCred balances to purchases, discounts, or content access.

Exploitation requires only a valid Subscriber account, which is trivial to obtain on WordPress sites permitting open user registration. No user interaction beyond the attacker's own session is required, and the attack is performed over the network against the WordPress administrative endpoints exposed by the plugin.

Root Cause

The root cause is missing or insufficient capability checks (current_user_can()) and nonce validation on action handlers within myCred versions <= 3.0.3. The plugin authenticates the requestor but does not authorize the requested action against the user's role, violating the principle of least privilege.

Attack Vector

The attack vector is network-based and requires low privileges. An attacker registers or compromises a Subscriber account, then submits crafted requests to myCred action endpoints (such as AJAX handlers or admin-post routes) to trigger functionality that should be gated by higher capabilities. See the Patchstack advisory for myCred 3.0.3 for additional context.

// No verified exploit code is published. Refer to the Patchstack advisory
// for technical details on the affected endpoints and parameters.

Detection Methods for CVE-2026-40794

Indicators of Compromise

Unexpected modifications to myCred point balances, logs, or settings originating from Subscriber-role accounts
POST requests to myCred AJAX or admin-post endpoints from users without administrative privileges
New or modified entries in the mycred_log database table not tied to legitimate administrator activity
Spikes in registrations followed quickly by myCred-related API calls from the same accounts

Detection Strategies

Review WordPress access logs for requests to myCred action handlers (URLs containing mycred) issued by non-administrator user IDs
Audit the wp_usermeta and myCred log tables for balance changes that do not correlate with legitimate transactions
Enable WordPress audit logging plugins to capture role-scoped action attempts and flag privilege mismatches

Monitoring Recommendations

Alert on HTTP 200 responses to myCred admin-ajax actions when the authenticated session belongs to a Subscriber
Monitor for sudden point balance increases or administrative setting changes outside maintenance windows
Track new Subscriber registrations followed by writes to myCred-managed tables within a short interval

How to Mitigate CVE-2026-40794

Immediate Actions Required

Upgrade the myCred plugin to a version above 3.0.3 that addresses the broken access control issue
Audit Subscriber-level accounts for suspicious activity and reset compromised credentials
Temporarily disable open user registration if a patched version cannot be deployed immediately

Patch Information

A fixed release is referenced in the Patchstack advisory for the myCred plugin. Site operators should update myCred through the WordPress plugin manager and verify the installed version after upgrade.

Workarounds

Restrict access to myCred AJAX and admin-post endpoints at the web server or WAF layer for non-administrator sessions
Disable new user registration (Settings > General > Anyone can register) until patched
Apply a virtual patch using a WordPress firewall plugin to block unauthenticated and Subscriber-level requests to vulnerable myCred actions

bash

# Update myCred via WP-CLI once a fixed version is available
wp plugin update mycred
wp plugin get mycred --field=version

# Disable open registration as a temporary mitigation
wp option update users_can_register 0