Not rated
CVE-2022-0287 The myCred WordPress plugin before 2.4.4.1 does not have any authorisation in place in its mycred-tools-select-user AJAX…
Description
The myCred WordPress plugin before 2.4.4.1 does not have any authorisation in place in its mycred-tools-select-user AJAX action, allowing any authenticated user, such as subscriber to call and retrieve all email addresses from the blog
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| myCred 2.4 | earliest → < 2.4.4.1 | 2.4.4.1 |
Other CVEs of myCred
The 4 CVEs of myCred →
CVE-2026-15150
The myCred WordPress plugin before 3.2.5 does not verify that the receiver of an incoming payment gateway notification…
5.3
Medium
CVE-2022-1092
The myCred WordPress plugin before 2.4.3.1 does not have authorisation and CSRF checks in its mycred-tools-import-export…
Not rated
CVE-2022-0363
The myCred WordPress plugin before 2.4.3.1 does not have any authorisation and CSRF checks in the…
Not rated