Brute-Force Vulnerability in WPCOM Member Plugin by WordPress
CVE-2026-123711
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 13 November 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-123711?
The WPCOM Member plugin prior to version 1.8.3 has a vulnerability that allows unauthorized attackers to exploit the WeChat login mechanism. Specifically, it fails to limit the number of attempts to verify login codes. This oversight permits an attacker to perform brute-force attacks on codes issued to other users, which can lead to unauthorized account access, including administrative accounts, when keyword login functionality with WeChat is enabled.
Affected Version(s)
WPCOM Member 0 < 1.8.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.