Authentication Bypass Vulnerability in WPCOM Member Plugin for WordPress
CVE-2025-1475
9.8CRITICAL
What is CVE-2025-1475?
The WPCOM Member plugin for WordPress is susceptible to an authentication bypass vulnerability across all versions up to and including 1.7.5. This vulnerability stems from inadequate verification of the 'user_phone' parameter during the login process. As a result, unauthenticated attackers could potentially gain access to any existing user account on the site, including administrative accounts, if SMS-based login is enabled. This could lead to unauthorized actions and a compromise of the site's security. Website administrators are urged to review their plugin configurations and apply any updates to mitigate this risk.
Affected Version(s)
WPCOM Member * <= 1.7.5