Authentication Bypass Vulnerability in RingCentral Communications Plugin for WordPress
CVE-2025-7955
9.8CRITICAL
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 28 August 2025
What is CVE-2025-7955?
The RingCentral Communications plugin for WordPress contains a vulnerability that allows attackers to bypass authentication. Due to insufficient validation in the ringcentral_admin_login_2fa_verify() function, unauthenticated users can gain access to any user account by submitting identical bogus codes. This significant security flaw affects several versions of the plugin, making it imperative for users to update to secure versions to protect their information and services.
Affected Version(s)
RingCentral Communications Plugin – FREE 1.5 <= 1.6.8