{"id":"CVE-2026-115962","aliases":[],"cve":{"records":[{"id":"CVE-2026-115962","source":"Patchstack","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-24T00:18:41.994Z","published":"2026-10-29T11:00:25.822Z","modified":"2026-10-29T12:36:51.694Z"}],"publishers":[{"name":"Patchstack","role":"CNA","organizationId":"21595511-bba5-4825-b968-b78d1f9984a3","modified":"2026-10-29T11:00:25.822Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-29T12:36:51.694Z"}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/mycred/vulnerability/wordpress-mycred-plugin-4-0-1-bypass-vulnerability-vulnerability?_s_id=cve","tags":["vdb-entry"],"source":"Patchstack"}],"weaknesses":[{"id":"CWE-290","description":"Authentication Bypass by Spoofing","source":"Patchstack"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-29T12:18:03.748784Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"WordPress myCred plugin <= 4.0.1 - Bypass Vulnerability vulnerability","titleSource":"Patchstack","descriptionSource":"Patchstack","description":"Authentication Bypass by Spoofing vulnerability in myCred myCred mycred allows Identity Spoofing.This issue affects myCred: from n/a through 4.0.1.","score":4.3,"severity":"medium","published":"2026-10-29T11:00:25.822Z","modified":"2026-10-29T12:36:51.694Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"myCred","name":"myCred","platforms":[],"versions":[{"version":"0","status":"affected","lessThanOrEqual":"4.0.1","versionType":"custom","changes":[{"at":"4.0.2","status":"unaffected"}]}],"defaultStatus":"unaffected","cpes":[],"source":"Patchstack","url":"https://www.cve.org/CVERecord?id=CVE-2026-115962"}],"remediation":[{"text":"Update the WordPress myCred plugin to the latest available version (at least 4.0.2).","source":"Patchstack","url":"https://www.cve.org/CVERecord?id=CVE-2026-115962"}],"references":["https://patchstack.com/database/wordpress/plugin/mycred/vulnerability/wordpress-mycred-plugin-4-0-1-bypass-vulnerability-vulnerability?_s_id=cve"],"sources":[{"name":"CVE","id":"CVE-2026-115962","modified":"2026-10-29T12:36:51.694Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-115962"}],"assessments":[{"source":"Patchstack","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","score":4.3}],"sourceAffected":[],"observedAt":"2026-10-29T14:34:42.493Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T09:15:31.262Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-10-29T11:15:34.172Z","attemptedAt":"2026-10-29T11:15:34.172Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-29T11:15:34.354Z","attemptedAt":"2026-10-29T11:15:34.354Z"},{"source":"EUVD","status":"refresh-failed","attemptedAt":"2026-10-29T11:15:33.745Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-29T11:15:37.595Z","attemptedAt":"2026-10-29T11:15:37.595Z"}],"evidence":[],"aiSummary":{"text":"The WordPress myCred plugin, versions up to 4.0.1, has an authentication bypass vulnerability by spoofing, allowing identity spoofing. The weakness is described as authentication bypass by spoofing. This issue affects myCred versions from unknown through 4.0.1.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:25:56.399Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-115962"}]}}