Local File Inclusion Vulnerability in WPCOM Member Plugin by WordPress

CVE-2025-11920

What is CVE-2025-11920?

The WPCOM Member plugin for WordPress is affected by a Local File Inclusion (LFI) vulnerability that allows authenticated users with Contributor-level access or higher to exploit the action parameter in its shortcodes. This flaw enables attackers to include and execute arbitrary PHP files stored on the server, leading to potential code execution and sensitive data exposure. Such exploitation can compromise the security of the website and bypass existing access controls, making it crucial for users to update to the latest version to mitigate these risks.

References