The myCred WordPress plugin before 2.4.3.1 does not have any authorisation and CSRF checks in the mycred-tools-import-export AJAX action, allowing any authenticated users, such as subscribers, to call it and import mycred setup, thus creating badges, managing points or creating arbitrary posts.
References
| Link | Resource |
|---|---|
| https://wpscan.com/vulnerability/a438a951-497c-43cd-822f-1a48d4315191 | Exploit Third Party Advisory |
| https://wpscan.com/vulnerability/a438a951-497c-43cd-822f-1a48d4315191 | Exploit Third Party Advisory |
Configurations
History
17 Oct 2025, 16:52
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Wpexperts
Wpexperts mycred |
|
| CPE | cpe:2.3:a:wpexperts:mycred:*:*:*:*:*:wordpress:*:* |
21 Nov 2024, 06:38
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://wpscan.com/vulnerability/a438a951-497c-43cd-822f-1a48d4315191 - Exploit, Third Party Advisory |
07 Nov 2023, 03:41
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-862 |
24 Jul 2023, 10:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | The myCred WordPress plugin before 2.4.3.1 does not have any authorisation and CSRF checks in the mycred-tools-import-export AJAX action, allowing any authenticated users, such as subscribers, to call it and import mycred setup, thus creating badges, managing points or creating arbitrary posts. |
20 Jul 2023, 18:07
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-352 |
Information
Published : 2022-04-25 16:16
Updated : 2025-10-17 16:52
NVD link : CVE-2022-0363
Mitre link : CVE-2022-0363
CVE.ORG link : CVE-2022-0363
JSON object : View
Products Affected
wpexperts
- mycred