CVE-2025-14002

HIGH

WPCOM Member <1.7.16 - Auth Bypass

Title source: llm
STIX 2.1

Description

The WPCOM Member plugin for WordPress is vulnerable to authentication bypass via brute force in all versions up to, and including, 1.7.16. This is due to weak OTP (One-Time Password) generation using only 6 numeric digits combined with a 10-minute validity window and no rate limiting on verification attempts. This makes it possible for unauthenticated attackers to brute-force the verification code and authenticate as any user, including administrators, if they know the target's phone number, and the target does not notice or ignores the SMS notification with the OTP.

Scores

CVSS v3 8.1
EPSS 0.0036
EPSS Percentile 58.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-287
Status published
Products (1)
whyun/WPCOM Member < 1.7.16
Published Dec 16, 2025
Tracked Since Feb 18, 2026