Description

Missing Authorization vulnerability in myCred New User Approve allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects New User Approve: from n/a through 3.2.8.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-20T13:17:27.100Z",
  "pubdate": "2026-08-20T13:17:27.100Z",
  "executiveSummary": "A Missing Authorization vulnerability has been identified in the myCred New User Approve plugin, specifically affecting versions ranging from n/a through 3.2.8. This security defect introduces flaws in access control enforcement, enabling threat actors to exploit incorrectly configured security levels within the application.\nThe primary impact of this vulnerability involves the potential bypass of intended authorization checks, allowing unauthorized users to interact with sensitive functionalities restricted to higher privilege tiers. The risk implications are severe, as successful exploitation may compromise user management workflows and lead to unauthorized privilege escalation or administrative state manipulation.\nThe vulnerability requires network connectivity to the target WordPress installation where the affected plugin is active. Depending on the specific misconfiguration, attackers may not require prior authentication, relying instead on the missing authorization boundary checks in the vulnerable component to execute unauthorized requests.\nOrganizations utilizing the affected product must prioritize remediation to prevent exploitation of access control mechanisms and maintain system integrity.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient or absent authorization validation checks within the myCred New User Approve plugin, spanning versions n/a through 3.2.8. Specifically, the vulnerable component fails to adequately verify whether the incoming request originates from a user possessing the requisite administrative or managerial privileges before processing sensitive actions related to user approval workflows.\nFrom an architectural perspective, the application exposes functions or endpoints responsible for managing user accounts without enforcing strict role-based access control (RBAC) or capability checks. Consequently, an attacker can directly invoke these restricted backend routines over the network by crafting HTTP requests targeting the exposed handlers.\nThe attack flow proceeds as follows: First, the adversary identifies the exposed functionality within the New User Approve component. Second, the attacker formulates a malicious payload or direct request directed at the vulnerable endpoint, bypassing the user interface where access controls might be visually enforced. Third, because the underlying code lacks robust server-side authorization validation (such as current_user_can() checks or nonce verification in vulnerable functions), the application processes the request as if it were authorized.\nThis execution leads to improper state changes regarding user approvals, potentially allowing unauthorized actors to approve pending registrations, manipulate user roles, or otherwise subvert the intended security boundaries of the WordPress environment. The post-exploitation impact includes unauthorized administrative control over newly registered accounts, potential persistence via elevated privileges, and disruption of identity governance processes managed by the plugin."
}