PT-2025-44697 · WordPress · Wpcom Member+1
Naoya Takahashi
·
Published
2025-11-01
·
Updated
2025-11-15
·
CVE-2025-11920
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
WPCOM Member versions prior to 1.7.15
Description
The WPCOM Member plugin for WordPress is susceptible to Local File Inclusion. This issue affects versions up to and including 1.7.14 and is triggered through the
action parameter within a shortcode. Authenticated attackers with Contributor-level access or higher can exploit this to include and execute arbitrary .php files on the server. Successful exploitation allows for the execution of PHP code, potentially enabling attackers to bypass access controls and obtain sensitive data. The issue can lead to code execution if .php file uploads are permitted. The vulnerable parameter is action.Recommendations
Update WPCOM Member to version 1.7.15 or later.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Wpcom Member
Wordpress