The myCred plugin for WordPress suffers from a missing authorization vulnerability (CWE-862) in versions up to 2.9.7.1. This flaw allows authenticated users with minimal privileges (Subscriber-level and above) to access sensitive user data through the get_bank_accounts AJAX action without proper permission verification. The vulnerability does not expose passwords but leaks personally identifiable information including user IDs, display names, and email addresses. The CVSS 3.1 base score is 4.3, reflecting a medium severity impact with network attack vector, low attack complexity, and requiring privileges but no user interaction.

An attacker with Subscriber-level access can retrieve sensitive user information such as user IDs, display names, and email addresses of all users on the affected WordPress site. This information disclosure could facilitate targeted phishing or social engineering attacks. Passwords are not exposed, and there is no indication of integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level access to trusted users only and monitor for suspicious activity related to the get_bank_accounts AJAX action. Avoid exposing this plugin on publicly accessible sites without proper access controls.