CVE-2025-11920highCWE-98

CVE-2025-11920: fallo de gravedad alta en whyun WPCOM Member

WPCOM Member <= 1.7.14 - Authenticated (Contributor+) Local File Inclusion via Shortcode

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear WPCOM Member

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.8epss 0.6%
The WPCOM Member plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7.14 via the action parameter in one of its shortcodes. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Productos afectados
whyun · WPCOM Member
CVEs relacionadas — whyun WPCOM Member

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-2221HIGHWPCOM Member <= 1.7.6 - Unauthenticated Time-Based SQL InjectionEPSS 1.7%CVE-2025-1475CRITICALWPCOM Member <= 1.7.5 - Authentication Bypass via 'user_phone'EPSS 0.6%CVE-2024-7493CRITICALWPCOM Member <= 1.5.2.1 - Unauthenticated Privilege Escalation via User MetaEPSS 0.6%CVE-2025-14002HIGHWPCOM Member <= 1.7.16 - Authentication Bypass via Weak OTPEPSS 0.5%CVE-2026-104803CRITICALWPCOM Member <= 1.7.27 - Unauthenticated Authentication Bypass via 'uuid' and 'code' Parameters on Social-Login CallbackEPSS 0.4%