PT-2025-51087 · WordPress · Mycred

Rafshanzani Suhada · Publicado 2025-12-13 · Atualizado 2025-12-13 · CVE-2025-12362

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program plugin for WordPress versions through 2.9.7

Description The software does not properly verify user authorization, allowing unauthenticated attackers to perform actions without proper access. Specifically, attackers can approve withdrawal requests, modify user point balances, and manipulate the payment processing system. This is achieved through the cashcred pay now API endpoint.

Recommendations Update to version 2.9.7.1 or later.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2025-12362

Produtos afetados

Mycred

Referências · 6

• https://twitter.com/CVEnew/status/1999865338327155161 · Publicação no Twitter
• https://plugins.trac.wordpress.org/changeset/3417299/mycred/trunk?contextall=1&old=3410754&old_path=%2Fmycred%2Ftrunk#file0 · Nota
• https://twitter.com/VolerionSec/status/1999892861651750991 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/mycred/tags/2.9.5.1/addons/cash-creds/modules/cashcred-module-core.php#L141 · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/af54654b-60af-446d-b170-ee0a1ebed22c?source=cve · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-12362 · Nota de Segurança