CVE-2025-12362

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12362", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-27T17:02:30.340Z", "datePublished": "2025-12-13T05:42:41.229Z", "dateUpdated": "2026-04-08T17:15:32.696Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:15:32.696Z"}, "affected": [{"vendor": "saadiqbal", "product": "Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.9.7", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The myCred \u2013 Points Management System For Gamification, Ranks, Badges, and Loyalty Program plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.9.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to approve withdrawal requests, modify user point balances, and manipulate the payment processing system via the cashcred_pay_now AJAX action."}], "title": "myCred \u2013 Points Management System For Gamification, Ranks, Badges, and Loyalty Program <= 2.9.7 - Missing Authorization to Unauthenticated Withdrawal Request Approval", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/af54654b-60af-446d-b170-ee0a1ebed22c?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/mycred/tags/2.9.5.1/addons/cash-creds/modules/cashcred-module-core.php#L141"}, {"url": "https://plugins.trac.wordpress.org/changeset/3417299/mycred/trunk?contextall=1&old=3410754&old_path=%2Fmycred%2Ftrunk#file0"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Rafshanzani Suhada"}], "timeline": [{"time": "2025-11-19T16:34:39.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-12-12T17:05:13.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-15T15:24:51.929358Z", "id": "CVE-2025-12362", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-15T15:33:06.583Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12362", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-15T15:24:51.929358Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-15T15:24:52.947Z"}}], "cna": {"title": "myCred \u2013 Points Management System For Gamification, Ranks, Badges, and Loyalty Program <= 2.9.7 - Missing Authorization to Unauthenticated Withdrawal Request Approval", "credits": [{"lang": "en", "type": "finder", "value": "Rafshanzani Suhada"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "saadiqbal", "product": "Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.9.7"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-19T16:34:39.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-12-12T17:05:13.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/af54654b-60af-446d-b170-ee0a1ebed22c?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/mycred/tags/2.9.5.1/addons/cash-creds/modules/cashcred-module-core.php#L141"}, {"url": "https://plugins.trac.wordpress.org/changeset/3417299/mycred/trunk?contextall=1&old=3410754&old_path=%2Fmycred%2Ftrunk#file0"}], "descriptions": [{"lang": "en", "value": "The myCred \u2013 Points Management System For Gamification, Ranks, Badges, and Loyalty Program plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.9.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to approve withdrawal requests, modify user point balances, and manipulate the payment processing system via the cashcred_pay_now AJAX action."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:15:32.696Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12362", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:15:32.696Z", "dateReserved": "2025-10-27T17:02:30.340Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-13T05:42:41.229Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred", "vendor": "saadiqbal", "versions": [{"lessThanOrEqual": "2.9.7", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The myCred \u2013 Points Management System For Gamification, Ranks, Badges, and Loyalty Program plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.9.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to approve withdrawal requests, modify user point balances, and manipulate the payment processing system via the cashcred_pay_now AJAX action."}, {"lang": "es", "value": "El plugin myCred - Sistema de Gesti\u00f3n de Puntos para Gamificaci\u00f3n, Rangos, Insignias y Programa de Lealtad para WordPress es vulnerable a Falta de Autorizaci\u00f3n en versiones hasta la 2.9.7, inclusive. Esto se debe a que el plugin no verifica correctamente que un usuario est\u00e1 autorizado para realizar una acci\u00f3n. Esto permite que atacantes no autenticados aprueben solicitudes de retiro, modifiquen los saldos de puntos de los usuarios y manipulen el sistema de procesamiento de pagos a trav\u00e9s de la acci\u00f3n AJAX cashcred_pay_now."}], "id": "CVE-2025-12362", "lastModified": "2026-10-07T20:10:01.970", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12362", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-15T15:24:51.929358Z", "version": "2.0.3"}}]}, "published": "2025-12-13T16:16:46.373", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/mycred/tags/2.9.5.1/addons/cash-creds/modules/cashcred-module-core.php#L141"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3417299/mycred/trunk?contextall=1&old=3410754&old_path=%2Fmycred%2Ftrunk#file0"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/af54654b-60af-446d-b170-ee0a1ebed22c?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T00:46:52.487986+00:00", "value": {"mitigation_remediation": ["Upgrade the myCred plugin to the latest release, which implements proper authorization for the cashcred_pay_now action and removes the exploit path.", "If an upgrade is not immediately possible, configure WordPress or your web server to restrict access to the cashcred_pay_now AJAX endpoint so that only authenticated users with appropriate privileges can invoke it.", "Audit and, if necessary, disable unused cashcred modules or phishing endpoints to reduce the attack surface, ensuring that only required AJAX actions remain exposed."], "summary": {"action": "Apply Patch", "impact": "Unauthorized modification of user point balances and withdrawal approvals leading to potential financial loss."}, "threat_synthesis": {"affected_systems": "The vulnerability affects the myCred plugin by saadiqbal, specifically versions up to and including 2.9.7. WordPress sites running any of these releases are at risk.", "description_and_impact": "The myCred Points Management System plugin for WordPress has a missing authorization flaw that allows unauthenticated users to approve withdrawal requests, alter user point balances, and tamper with payment processing through the cashcred_pay_now AJAX action. This integrity violation could enable attackers to drain points, redistribute rewards, or manipulate payouts, potentially resulting in financial loss. The weakness is a classic authorization bypass, identified as CWE\u2011862.", "risk_and_exploitability": "The CVSS score of 5.3 indicates moderate severity, while an EPSS of less than 1% suggests a very low likelihood of active exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by sending unauthenticated HTTP requests to the cashcred_pay_now AJAX endpoint, bypassing all permission checks."}}}}, "created": "2025-12-14T21:14:41.336589+00:00", "updated": "2026-04-21T01:00:12.928085+00:00", "vendors": ["mycred", "mycred$PRODUCT$mycred", "saadiqbal", "saadiqbal$PRODUCT$mycred", "wordpress", "wordpress$PRODUCT$wordpress"]}