Description (CNA)
The myCred WordPress plugin before 2.4.3.1 does not have any authorisation and CSRF checks in the mycred-tools-import-export AJAX action, allowing any authenticated users, such as subscribers, to call it and import mycred setup, thus creating badges, managing points or creating arbitrary posts.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Unknown / myCred | affected 0 before 2.4.3.1 |
CWE
No CWE identifiers supplied.
References
ADP enrichment
No English description supplied.