Critical severity · published Mar 7, 2025
CVE-2025-1475
WPCOM Member <= 1.7.5 - Authentication Bypass via 'user_phone'
9.8
CVSS
0.6%
EPSS
No
On KEV
Description
The WPCOM Member plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.7.5. This is due to insufficient verification on the 'user_phone' parameter when logging in. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if SMS login is enabled.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WM
WPCOM Member · whyun
through 1.7.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-1475
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-1475
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/wpcom-member/tags/1.7.1/includes/form-validation.php#L110
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset/3248208/
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/05178bf3-3040-41aa-ba43-779376d30298?source=cve
More from WPCOM Member
9.8
CVE-2026-104803
WPCOM Member <= 1.7.27 - Unauthenticated Authentication Bypass via 'uuid' and 'code' Parameters on Social-Login Callback
9.8
CVE-2024-7493
WPCOM Member <= 1.5.2.1 - Unauthenticated Privilege Escalation via User Meta
8.8
CVE-2025-11920
WPCOM Member <= 1.7.14 - Authenticated (Contributor+) Local File Inclusion via Shortcode
8.1
CVE-2025-14002
WPCOM Member <= 1.7.16 - Authentication Bypass via Weak OTP
7.5
CVE-2025-2221
WPCOM Member <= 1.7.6 - Unauthenticated Time-Based SQL Injection