title: myCred < 2.4.4 - Subscriber+ Import/Export to Email Address Disclosure
description: The myCred WordPress plugin before 2.4.3.1 does not have authorisation and CSRF checks in its mycred-tools-import-export AJAX action, allowing any authenticated user to call and and retrieve the list of email address present in the blog
problem types: CWE-862 Missing Authorization
affected:
{
vendor: Unknown
product: myCred
versions:
status: affected, versionType: custom, version: 0, lessThan: 2.4.3.1
defaultStatus: unaffected
collectionURL: https://wordpress.org/plugins
}