CVE-2022-0287: Mycred < 2.4.4.1 - Subscriber+ User E-mail Addresses Disclosure

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-04-25 · updated 2026-06-17
Weakness: CWE-862

Description

The myCred WordPress plugin before 2.4.4.1 does not have any authorisation in place in its mycred-tools-select-user AJAX action, allowing any authenticated user, such as subscriber to call and retrieve all email addresses from the blog

Affected products

Saad Iqbal myCred: before 2.4.4.1 — fixed in 2.4.4.1

How to fix

Upgrade to a fixed version: Saad Iqbal myCred 2.4.4.1. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/6cd7cd6d-1cc1-472c-809b-b66389f149b0
https://wpscan.com/vulnerability/6cd7cd6d-1cc1-472c-809b-b66389f149b0

Get alerted when CVE-2022-0287 or the next vulnerability affects your stack