CVE-2025-12362

The myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.9.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to approve withdrawal requests, modify user point balances, and manipulate the payment processing system via the cashcred_pay_now AJAX action.

• CWE-862

• https://plugins.trac.wordpress.org/browser/mycred/tags/2.9.5.1/addons/cash-creds/modules/cashcred-module-core.php#L141
• https://plugins.trac.wordpress.org/changeset/3417299/mycred/trunk?contextall=1&old=3410754&old_path=%2Fmycred%2Ftrunk#file0
• https://www.wordfence.com/threat-intel/vulnerabilities/id/af54654b-60af-446d-b170-ee0a1ebed22c?source=cve

Published

Dec 13, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-12356The Tickera – Sell Tickets & Manage Events plugin for WordPr…4.3
• CVE-2025-12357By manipulating the Signal Level Attenuation Characterizatio…6.3
• CVE-2025-12358The ShopEngine Elementor WooCommerce Builder Addon plugin fo…4.3
• CVE-2025-12359The Responsive Lightbox & Gallery plugin for WordPress is vu…5.4
• CVE-2025-12360The Better Find and Replace – AI-Powered Suggestions plugin …4.3
• CVE-2025-12361The myCred – Points Management System For Gamification, Rank…4.3
• CVE-2025-12363Email Password Disclosure.This issue affects BLU-IC2: throug…7.5
• CVE-2025-12364Weak Password Policy.This issue affects BLU-IC2: through 1.1…9.8
• CVE-2025-12365Error Messages Wrapped In HTTP Header.This issue affects BLU…5.3
• CVE-2025-12366The Page Builder: Pagelayer – Drag and Drop website builder …4.3
• CVE-2025-12367The SiteSEO – SEO Simplified plugin for WordPress is vulnera…4.3
• CVE-2025-12368The Sermon Manager plugin for WordPress is vulnerable to Sto…6.4