Skip to content
OpenAdvisories

Vendor

whyun

6 known vulnerabilities.

Products

WPCOM Member 6
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.1
    CVE-2025-14002

    WPCOM Member <= 1.7.16 - Authentication Bypass via Weak OTP

    The WPCOM Member plugin for WordPress is vulnerable to authentication bypass via brute force in all versions up to, and including, 1.7.16. This is due to weak OTP (One-Time Password) generation using only 6 numeric digits combined with a 10-minute validity wi…

    whyun WPCOM Member Web / CMS
  • High 8.8
    CVE-2025-11920

    WPCOM Member <= 1.7.14 - Authenticated (Contributor+) Local File Inclusion via Shortcode

    The WPCOM Member plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7.14 via the action parameter in one of its shortcodes. This makes it possible for authenticated attackers, with Contributor-level access and a…

    whyun WPCOM Member Web / CMS
  • High 7.5
    CVE-2025-2221

    WPCOM Member <= 1.7.6 - Unauthenticated Time-Based SQL Injection

    The WPCOM Member plugin for WordPress is vulnerable to time-based SQL Injection via the ‘user_phone’ parameter in all versions up to, and including, 1.7.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the ex…

    whyun WPCOM Member Web / CMS