CVE-2026-15150: 
WordPress vulnerability analysis and mitigation

CVE-2026-15150 is an unauthenticated payment bypass vulnerability in the myCred WordPress plugin, specifically within its buyCRED payment gateway integration. The flaw allows attackers to have arbitrary amounts of in-site currency credited to any account by spoofing PayPal IPN (Instant Payment Notification) receiver verification. All versions of myCred before 3.2.5 are affected. It was publicly disclosed on August 17, 2026, and assigned a CVSS v3.1 base score of 5.3 (Medium) (WPScan, Github Advisory).

The root cause is classified as CWE-345 (Insufficient Verification of Data Authenticity). The plugin's buyCRED module processes incoming payment gateway notifications (e.g., PayPal IPN) without verifying that the notification's receiver field matches the site's configured merchant account. An unauthenticated attacker can complete a legitimate payment of the expected amount to a payment gateway account they control, then trigger or replay the resulting notification to the vulnerable WordPress site, causing the plugin to credit arbitrary in-site currency to a chosen account. No authentication or special privileges are required, and the attack is fully automatable over the network (WPScan, Github Advisory). A proof-of-concept is scheduled for public release on August 31, 2026, to allow time for users to update (WPScan).

Successful exploitation allows an unauthenticated attacker to credit arbitrary amounts of the site's in-site currency (points, credits, or tokens managed by myCred) to any user account, effectively enabling fraudulent acquisition of digital goods, services, or rewards funded by the site. There is no confidentiality or availability impact; the primary risk is integrity loss through manipulation of virtual economy balances. Sites using myCred for e-commerce, gamification, or loyalty programs are most at risk, as attackers could drain virtual inventories or gain unfair advantages without spending real money (WPScan, Github Advisory).

No public proof-of-concept exploit is currently available, though WPScan has indicated one will be published on August 31, 2026. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.0, reflecting low current exploitation probability. However, the attack is automatable and requires no authentication, making it a low-barrier threat once a PoC is released (WPScan, Github Advisory).

1. Reconnaissance: Identify WordPress sites running the myCred plugin (versions before 3.2.5) with buyCRED payment functionality enabled, using tools like WPScan or by inspecting publicly visible plugin metadata.
2. Set up attacker-controlled gateway account: Register a PayPal (or other supported gateway) account under the attacker's control.
3. Initiate a legitimate payment: Complete a payment for the expected/minimum required amount to the attacker's own gateway account (not the site's merchant account).
4. Craft or replay the IPN notification: Send or replay the resulting payment gateway notification (e.g., PayPal IPN POST request) to the target WordPress site's IPN listener endpoint, substituting the receiver field with the attacker's account details.
5. Currency credited: Because the plugin does not verify the receiver matches the site's configured merchant account, it processes the notification as valid and credits the specified amount of in-site currency to the attacker's chosen user account (WPScan).

• Network: Unexpected or repeated POST requests to the site's PayPal IPN listener endpoint (e.g., /wp-admin/admin-ajax.php or a dedicated IPN URL) from unusual IP addresses or with receiver fields not matching the site's merchant email.
• Logs: WordPress or web server access logs showing IPN notification requests with mismatched or unknown receiver/merchant account values; multiple rapid IPN requests for the same transaction ID.
• Application: Sudden, unexplained spikes in myCred balance for one or more user accounts; transaction logs in myCred showing large credit events tied to payment notifications with no corresponding legitimate purchase on the site's merchant account.

Update the myCred WordPress plugin to version 3.2.5 or later, which introduces proper verification that the receiver of incoming payment gateway notifications matches the site's configured merchant account (WPScan). As an interim measure, site administrators should review myCred transaction logs for anomalous balance credits and consider temporarily disabling the buyCRED payment gateway integration until the patch is applied. Additionally, implementing signature verification or HMAC checks on incoming payment notifications at the server or WAF level can provide an extra layer of defense.