Login Request a demo
High severity · published Nov 1, 2025
CVE-2025-11920
WPCOM Member <= 1.7.14 - Authenticated (Contributor+) Local File Inclusion via Shortcode
8.8
CVSS
0.6%
EPSS
No
On KEV
Description
The WPCOM Member plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7.14 via the action parameter in one of its shortcodes. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WM
WPCOM Member · whyun
through 1.7.14 · source: vendor
Affected product
WM
WPCOM Member
whyun
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-11920
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-11920
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/wpcom-member/tags/1.7.13/includes/class-member.php#L1119
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/wpcom-member/tags/1.7.13/includes/class-member.php#L1171
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/wpcom-member/tags/1.7.13/includes/class-member.php#L374
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset/3385562/wpcom-member/trunk
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/43b04825-d1c6-4e2a-9035-1f4fbfe14818?source=cve
More from WPCOM Member
9.8
CVE-2026-104803
WPCOM Member <= 1.7.27 - Unauthenticated Authentication Bypass via 'uuid' and 'code' Parameters on Social-Login Callback
9.8
CVE-2025-1475
WPCOM Member <= 1.7.5 - Authentication Bypass via 'user_phone'
9.8
CVE-2024-7493
WPCOM Member <= 1.5.2.1 - Unauthenticated Privilege Escalation via User Meta
8.1
CVE-2025-14002
WPCOM Member <= 1.7.16 - Authentication Bypass via Weak OTP
7.5
CVE-2025-2221
WPCOM Member <= 1.7.6 - Unauthenticated Time-Based SQL Injection