PT-2025-11248 · WordPress · Wpcom Member

Wesley

·

Published

2025-03-14

·

Updated

2026-04-13

·

CVE-2025-2221

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions: WPCOM Member plugin for WordPress versions up to, and including, 1.7.6
Description: The issue is related to time-based SQL Injection via the user phone parameter due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. This allows unauthenticated attackers to append additional SQL queries into already existing queries, which can be used to extract sensitive information from the database.
Recommendations: For versions up to, and including, 1.7.6, update to a version that fixes the SQL Injection vulnerability. As a temporary workaround, consider restricting access to the user phone parameter to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-2221

Affected Products

Wpcom Member