The myCred plugin for WordPress, used for managing gamification points, ranks, badges, and loyalty rewards, contains a missing authorization vulnerability (CWE-862) in versions up to 2.9.7. Specifically, the plugin fails to verify that a user is authorized before allowing actions through the cashcred_pay_now AJAX endpoint. This enables unauthenticated attackers to approve withdrawal requests, alter user point balances, and interfere with payment processing. The CVSS 3.1 base score is 5.3 (medium severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to integrity loss.

An attacker without authentication can manipulate the points and payment system of the myCred plugin, potentially approving unauthorized withdrawals and modifying user balances. This compromises the integrity of the loyalty and rewards system but does not affect confidentiality or availability according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the cashcred_pay_now AJAX action or implementing custom authorization checks to prevent unauthorized use.