CVE-2022-0363: Wpexperts Mycred

Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days.

The myCred WordPress plugin before 2.4.3.1 does not have any authorisation and CSRF checks in the mycred-tools-import-export AJAX action, allowing any authenticated users, such as subscribers, to call it and import mycred setup, thus creating badges, managing points or creating arbitrary posts.

Affected products

• Wpexperts Mycred: before 2.4.3.1 (fixed in 2.4.3.1)

Published 2022-04-25. Last modified 2026-06-17.