CVE-2025-1475: critical vulnerability in whyun WPCOM Member
WPCOM Member <= 1.7.5 - Authentication Bypass via 'user_phone'
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.8epss 0.6%
The WPCOM Member plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.7.5. This is due to insufficient verification on the 'user_phone' parameter when logging in. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if SMS login is enabled.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
whyun · WPCOM MemberRelated CVEs — whyun WPCOM Member
In the same product, most dangerous first.
CVE-2025-2221HIGHWPCOM Member <= 1.7.6 - Unauthenticated Time-Based SQL InjectionEPSS 1.7%CVE-2024-7493CRITICALWPCOM Member <= 1.5.2.1 - Unauthenticated Privilege Escalation via User MetaEPSS 0.6%CVE-2025-11920HIGHWPCOM Member <= 1.7.14 - Authenticated (Contributor+) Local File Inclusion via ShortcodeEPSS 0.6%CVE-2025-14002HIGHWPCOM Member <= 1.7.16 - Authentication Bypass via Weak OTPEPSS 0.5%CVE-2026-104803CRITICALWPCOM Member <= 1.7.27 - Unauthenticated Authentication Bypass via 'uuid' and 'code' Parameters on Social-Login CallbackEPSS 0.4%