Missing Authorization Vulnerability in myCred Plugin for WordPress
CVE-2025-12361

4.3MEDIUM

Key Information:

Vendor

WordPress
Status
Mycred – Points Management System For Gamification, Ranks, Badges, And Loyalty Program.
Vendor
CVE Published:
19 December 2025

What is CVE-2025-12361?

The myCred plugin for WordPress allows authenticated users to access sensitive user data due to a lack of proper authorization checks. This vulnerability enables users with Subscriber-level access and higher to exploit the get_bank_accounts AJAX action, potentially leading to the exposure of user IDs, display names, and email addresses. It is crucial for site administrators to update the plugin to the latest version to mitigate this risk and safeguard user information.

Affected Version(s)

myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program. * <= 2.9.7.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/mycred/tags/2....
https://plugins.trac.wordpress.org/changeset/3421768/mycr...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Rafshanzani Suhada
JSON
.