Missing Authorization Vulnerability in myCred Points Management System for WordPress
CVE-2025-12362
5.3MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 13 December 2025
What is CVE-2025-12362?
The myCred plugin, used for points management and gamification on WordPress sites, contains a vulnerability that allows unauthorized users to manipulate key functionalities. Specifically, versions up to 2.9.7 fail to verify user authorization, enabling unauthenticated attackers to approve withdrawal requests and alter user point balances. This includes unauthorized modifications of the payment processing system through the AJAX action cashcred_pay_now. Proper user validation is crucial to safeguarding against such exploits.
Affected Version(s)
myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program. * <= 2.9.7