PT-2025-51087 · WordPress · Mycred

Rafshanzani Suhada · Published 2025-12-13 · Updated 2025-12-13 · CVE-2025-12362

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program plugin for WordPress versions through 2.9.7

Description The software does not properly verify user authorization, allowing unauthenticated attackers to perform actions without proper access. Specifically, attackers can approve withdrawal requests, modify user point balances, and manipulate the payment processing system. This is achieved through the cashcred pay now API endpoint.

Recommendations Update to version 2.9.7.1 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-12362

Affected Products

Mycred

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-12362 · Security Note
• https://twitter.com/CVEnew/status/1999865338327155161 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3417299/mycred/trunk?contextall=1&old=3410754&old_path=%2Fmycred%2Ftrunk#file0 · Note
• https://twitter.com/VolerionSec/status/1999892861651750991 · Twitter Post
• https://plugins.trac.wordpress.org/browser/mycred/tags/2.9.5.1/addons/cash-creds/modules/cashcred-module-core.php#L141 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/af54654b-60af-446d-b170-ee0a1ebed22c?source=cve · Note