CVE-2026-56013 is an authorization bypass vulnerability classified as CWE-639 affecting myCred License Manager for WooCommerce versions <= 3.0.15. The flaw arises from insecure direct object references that can be manipulated by unauthenticated users through user-controlled keys, potentially allowing unauthorized access or modification of license data. The vulnerability has a CVSS 3.1 score of 6.5 (medium severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts integrity and availability. No vendor advisory or patch is currently available, and no known exploits have been reported.

The vulnerability allows unauthenticated attackers to bypass authorization controls by exploiting insecure direct object references, potentially leading to unauthorized modification of license-related data or disruption of service availability. Confidentiality is not impacted according to the CVSS vector. The impact is limited to integrity and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, monitor vendor communications for updates. Avoid exposing the affected plugin to untrusted users or networks where possible.