PT-2025-51087
CVE-2025-12362
·
Publicado
2025-12-12
·
Atualizado
2025-12-13
Descrição por
CVSS 3.1
5.3
MédiaMétricasAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Name of the Vulnerable Software and Affected Versions
myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program plugin for WordPress versions through 2.9.7
Description
The software does not properly verify user authorization, allowing unauthenticated attackers to perform actions without proper access. Specifically, attackers can approve withdrawal requests, modify user point balances, and manipulate the payment processing system. This is achieved through the
cashcred pay now API endpoint.Recommendations
Update to version 2.9.7.1 or later.
Explorabilidade
Correção
Impactos
Fornecedores
Produtos afetados
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾