PT-2025-34967 · WordPress · Ringcentral Communications

Kenneth Dunn · Published 2025-08-28 · Updated 2025-08-28 · CVE-2025-7955

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: RingCentral Communications plugin for WordPress versions 1.5 through 1.6.8

Description: The RingCentral Communications plugin for WordPress is susceptible to authentication bypass due to insufficient validation within the ringcentral admin login 2fa verify() function. This allows unauthenticated attackers to log in as any user by providing arbitrary codes.

Recommendations: Update to a version beyond 1.6.8.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2025-7955

Affected Products

Ringcentral Communications

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2025-7955 · Security Note
• https://twitter.com/ZeroPathLabs/status/1960957197640167648 · Twitter Post
• https://twitter.com/offseq/status/1960945663690035223 · Twitter Post
• https://twitter.com/Nxploited/status/1961062338997436798 · Twitter Post
• https://plugins.trac.wordpress.org/browser/rccp-free/tags/1.6.8/ringcentral.php · Note
• https://plugins.trac.wordpress.org/changeset/3349361 · Note
• https://twitter.com/VulmonFeeds/status/1960993292641878427 · Twitter Post
• https://twitter.com/CVEnew/status/1960942980568600643 · Twitter Post
• https://t.me/CVEtracker/31102 · Telegram Post
• https://wordpress.org/plugins/rccp-free/#developers · Note
• https://t.me/cveNotify/133803 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/0386ed09-296d-4f33-9fe0-964c0c0a9652?source=cve · Note