Description

The myCred WordPress plugin before 3.2.5 does not verify that the receiver of an incoming payment gateway notification matches the site's configured merchant account, allowing unauthenticated attackers to have arbitrary amounts of the site's in-site currency credited to an account by completing a payment for the expected amount to a gateway account they control rather than the site's.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-21T12:16:22.963Z",
  "pubdate": "2026-08-21T12:16:22.963Z",
  "executiveSummary": "The myCred WordPress plugin before version 3.2.5 suffers from an insufficient validation vulnerability in its payment gateway notification handling mechanism. This security flaw enables unauthenticated attackers to manipulate incoming payment callbacks and fraudulently credit arbitrary amounts of in-site currency to user accounts.\nThe vulnerability impacts the myCred plugin across WordPress installations utilizing vulnerable versions prior to 3.2.5. The primary risk implication is financial and economic logic corruption within the application, allowing unauthorized acquisition of site currency without proper merchant compensation.\nAttacker capabilities include the execution of unauthenticated transactions and arbitrary currency manipulation. Exploitation requirements involve an attacker completing a legitimate payment transaction for the expected monetary amount to a payment gateway account under their direct control, rather than the legitimate merchant account configured by the site administrator, while spoofing or re-routing the corresponding webhook or notification to the target site.",
  "technicalDetails": "The root cause of the vulnerability stems from a lack of cryptographic or logical verification within the payment gateway notification handler of the myCred plugin. Specifically, the application fails to validate whether the recipient or merchant account specified in the incoming payment gateway notification payload matches the legitimate merchant account configured within the site settings.\nThe vulnerable component resides within the payment gateway integration module of the myCred WordPress plugin affecting versions prior to 3.2.5. The vulnerability is exploitable remotely over the network by unauthenticated actors without requiring any prior privileges within the WordPress application.\nThe attack flow proceeds as follows: First, the unauthenticated attacker initiates a transaction workflow or simulates a payment scenario targeting the vulnerable WordPress site. Second, instead of routing the funds to the legitimate merchant account owned by the site administrator, the attacker routes the payment of the exact expected amount to a payment gateway account that they fully control. Third, the attacker captures or crafts a valid payment gateway notification indicating that a payment has been successfully completed for the expected amount. Fourth, the attacker transmits this notification to the payment gateway listener endpoint exposed by the myCred plugin. Fifth, because the plugin lacks recipient validation, it processes the notification as authentic, blindly trusting the payload parameters. Finally, the plugin executes its internal crediting logic, resulting in arbitrary amounts of the site's in-site currency being credited to the attacker's designated account, achieving unauthorized economic enrichment."
}