The myCred WordPress plugin before 2.4.3.1 does not have any authorisation and CSRF checks in the mycred-tools-import-export AJAX action, allowing any authenticated users, such as subscribers, to call it and import mycred setup, thus creating badges, managing points or creating arbitrary posts.
References
| Link | Resource |
|---|---|
| https://wpscan.com/vulnerability/a438a951-497c-43cd-822f-1a48d4315191 | Exploit Third Party Advisory |
| https://wpscan.com/vulnerability/a438a951-497c-43cd-822f-1a48d4315191 | Exploit Third Party Advisory |
Configurations
History
17 Oct 2025, 16:52
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:wpexperts:mycred:*:*:*:*:*:wordpress:*:* | |
| First Time |
Wpexperts mycred
Wpexperts |
21 Nov 2024, 06:38
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://wpscan.com/vulnerability/a438a951-497c-43cd-822f-1a48d4315191 - Exploit, Third Party Advisory |
24 Jul 2023, 10:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | The myCred WordPress plugin before 2.4.3.1 does not have any authorisation and CSRF checks in the mycred-tools-import-export AJAX action, allowing any authenticated users, such as subscribers, to call it and import mycred setup, thus creating badges, managing points or creating arbitrary posts. |
20 Jul 2023, 18:07
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-352 |
03 May 2022, 18:56
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://wpscan.com/vulnerability/a438a951-497c-43cd-822f-1a48d4315191 - Exploit, Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : 4.0
v3 : 4.3 |
| CPE | cpe:2.3:a:mycred:mycred:*:*:*:*:*:wordpress:*:* |
25 Apr 2022, 16:30
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-04-25 16:16
Updated : 2025-10-17 16:52
NVD link : CVE-2022-0363
Mitre link : CVE-2022-0363
CVE.ORG link : CVE-2022-0363
JSON object : View
Products Affected
wpexperts
- mycred