The vulnerability identified as CVE-2026-28163 in the myCred New User Approve plugin is a missing authorization issue (CWE-862). It allows exploitation of incorrectly configured access control security levels, enabling unauthorized users to perform actions they should not be permitted to. The affected versions include all versions up to and including 3.2.8. The CVSS v3.1 base score is 5.3, reflecting a network attack vector with low attack complexity, no privileges required, no user interaction, and impact limited to integrity loss without confidentiality or availability impact. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

The impact is limited to integrity loss, meaning unauthorized modification or approval actions could be performed by attackers without proper authorization. There is no impact on confidentiality or availability. The vulnerability can be exploited remotely without authentication or user interaction, increasing the risk of unauthorized changes within the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin functionality and monitor for unauthorized changes. Avoid exposing the affected component to untrusted networks or users where possible.