PT-2025-51469 · WordPress · Wpcom Member

Wesley · Published 2025-12-16 · Updated 2025-12-18 · CVE-2025-14002

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WPCOM Member plugin for WordPress versions prior to 1.7.17

Description The software is susceptible to authentication bypass through brute-force attacks. This is caused by a weak One-Time Password (OTP) generation process, utilizing only six numeric digits with a ten-minute validity period and lacking rate limiting on verification attempts. An attacker knowing a target’s phone number can potentially bypass authentication as any user, including administrators, if the target does not promptly notice or disregard the SMS notification containing the OTP.

Recommendations Update the WPCOM Member plugin to version 1.7.17 or later.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2025-14002

Affected Products

Wpcom Member

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-14002 · Security Note
• https://plugins.trac.wordpress.org/browser/wpcom-member/tags/1.7.16/includes/member-functions.php#L833 · Note
• https://twitter.com/VulmonFeeds/status/2000914727715705016 · Twitter Post
• https://twitter.com/MNovofastovsky/status/2001714082211144002 · Twitter Post
• https://t.me/CVEtracker/39949 · Telegram Post
• https://plugins.trac.wordpress.org/browser/wpcom-member/tags/1.7.16/includes/class-sesstion.php#L29 · Note
• https://twitter.com/TheHackerWire/status/2000884869325578433 · Twitter Post
• https://t.me/cveNotify/145918 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3411048/wpcom-member · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/4f02ee56-40bd-4132-92e1-e2897ff2a4c4?source=cve · Note