CVE-2025-12361

The myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.9.7.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve sensitive information including user IDs, display names, and email addresses of all users on the site via the get_bank_accounts AJAX action. Passwords are not exposed.

• CWE-862

• https://plugins.trac.wordpress.org/browser/mycred/tags/2.9.5.1/addons/banking/services/mycred-service-central.php#L172
• https://plugins.trac.wordpress.org/changeset/3421768/mycred/trunk?contextall=1&old=3417299&old_path=%2Fmycred%2Ftrunk
• https://www.wordfence.com/threat-intel/vulnerabilities/id/43b05697-bc36-4f32-86b4-2feef892fe42?source=cve

Published

Dec 19, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-12355The Payaza plugin for WordPress is vulnerable to unauthorize…5.3
• CVE-2025-12356The Tickera – Sell Tickets & Manage Events plugin for WordPr…4.3
• CVE-2025-12357By manipulating the Signal Level Attenuation Characterizatio…6.3
• CVE-2025-12358The ShopEngine Elementor WooCommerce Builder Addon plugin fo…4.3
• CVE-2025-12359The Responsive Lightbox & Gallery plugin for WordPress is vu…5.4
• CVE-2025-12360The Better Find and Replace – AI-Powered Suggestions plugin …4.3
• CVE-2025-12362The myCred – Points Management System For Gamification, Rank…5.3
• CVE-2025-12363Email Password Disclosure.This issue affects BLU-IC2: throug…7.5
• CVE-2025-12364Weak Password Policy.This issue affects BLU-IC2: through 1.1…9.8
• CVE-2025-12365Error Messages Wrapped In HTTP Header.This issue affects BLU…5.3
• CVE-2025-12366The Page Builder: Pagelayer – Drag and Drop website builder …4.3
• CVE-2025-12367The SiteSEO – SEO Simplified plugin for WordPress is vulnera…4.3