CVE-2025-1475

Published: 2025-03-07T07:15Z

Last Modified: 2025-03-07T07:15Z

Source: MITRE CVE List

License: MITRE-CVE-TOS

The WPCOM Member plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.7.5. This is due to insufficient verification on the 'user_phone' parameter when logging in. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if SMS login is enabled. > MITRE Terms of Use apply – see LICENSE‑MITRE.txt