PT-2022-13127 · WordPress · Mycred

Name of the Vulnerable Software and Affected Versions: myCred WordPress plugin versions prior to 2.4.3.1 Description: The issue concerns the lack of authorization and CSRF checks in the mycred-tools-import-export AJAX action. This allows any authenticated users, such as subscribers, to call the...