CVE-2026-15150

The myCred WordPress plugin before 3.2.5 does not verify that the receiver of an incoming payment gateway notification matches the site's configured merchant account, allowing unauthenticated attackers to have arbitrary amounts of the site's in-site currency credited to an account by completing a...

EUVD-2026-63909

The myCred WordPress plugin before 3.2.5 does not verify that the receiver of an incoming payment gateway notification matches the site's configured merchant account, allowing unauthenticated attackers to have arbitrary amounts of the site's in-site currency credited to an account by completing a...

CVE-2026-15150

The myCred WordPress plugin before 3.2.5 contains an unauthenticated payment bypass in the buyCRED function. The plugin fails to verify that the receiver of an incoming payment gateway notification (e.g., PayPal IPN) matches the site's configured merchant account. An unauthenticated attacker can ...

CVE-2026-15150: Insufficient Verification of Data Authenticity

The myCred WordPress plugin before 3.2.5 does not verify that the receiver of an incoming payment gateway notification matches the site's configured merchant account, allowing unauthenticated attackers to have arbitrary amounts of the site's in-site currency credited to an account by completing a...

PT-2026-79368

Name of the Vulnerable Software and Affected Versions myCred WordPress plugin versions prior to 3.2.5 Description The plugin fails to verify if the receiver of an incoming payment gateway notification matches the configured merchant account. This allows unauthenticated attackers to credit arbitra...