blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-15150

MEDIUM 5.3 CVSS 3.1
Published
August 21, 2026
Last modified
October 16, 2026
NVD status
Deferred
Reported by
contact@wpscan.com
Weakness
CWE-345
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Description

The myCred WordPress plugin before 3.2.5 does not verify that the receiver of an incoming payment gateway notification matches the site's configured merchant account, allowing unauthenticated attackers to have arbitrary amounts of the site's in-site currency credited to an account by completing a payment for the expected amount to a gateway account they control rather than the site's.

Affected WordPress components

  • Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred Plugin · mycred
    Confirmed match Active
    Before 3.2.5
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • Unknown myCred — Before 3.2.5

References

  • wpscan.com https://wpscan.com/vulnerability/01fac9e6-2539-48ba-899a-7c5c338ea92b/
  • nvd.nist.gov Official NVD record