What’s Vulnerable › Vulnerabilities

CVE-2021-24755: myCred < 2.3 - Subscriber+ SQL Injection

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-11-29 · updated 2026-06-17
• Weakness: CWE-89

Description

The myCred WordPress plugin before 2.3 does not validate or escape the fields parameter before using it in a SQL statement, leading to an SQL injection exploitable by any authenticated user

Affected products

• Saad Iqbal myCred: before 2.3 — fixed in 2.3

How to fix

Upgrade to a fixed version: Saad Iqbal myCred 2.3. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/01419d03-54d6-413d-9a67-64c63c26d741
• https://wpscan.com/vulnerability/01419d03-54d6-413d-9a67-64c63c26d741

Get alerted when CVE-2021-24755 or the next vulnerability affects your stack