平台
wordpress
组件
wpcom-member
修复版本
1.7.6
CVE-2025-1475 is an authentication bypass vulnerability affecting the WPCOM Member plugin for WordPress. This flaw allows unauthenticated attackers to gain access to user accounts, potentially including administrator privileges, if SMS login is enabled. The vulnerability impacts versions 0.0.0 through 1.7.5. A fix is available in a subsequent version (check vendor advisory).
The impact of this vulnerability is severe. An attacker can leverage it to completely compromise a WordPress site by logging in as any user. This grants them full control over the site's content, configuration, and potentially its database. They could modify data, install malicious plugins, redirect users to phishing sites, or even use the compromised site as a launchpad for further attacks. The ability to impersonate an administrator significantly expands the attack surface and potential damage.
This vulnerability was publicly disclosed on 2025-03-07. The CRITICAL CVSS score indicates a high probability of exploitation. Public proof-of-concept code is likely to emerge, increasing the risk. Monitor security advisories and threat intelligence feeds for reports of active exploitation campaigns targeting vulnerable WordPress sites.
WordPress sites utilizing the WPCOM Member plugin, particularly those with SMS login enabled, are at significant risk. Shared hosting environments where plugin updates are managed centrally are also vulnerable if they haven't applied the patch. Sites with legacy WordPress configurations or those lacking robust security monitoring are especially susceptible.
• wordpress / composer / npm:
grep -r 'user_phone' /var/www/html/wp-content/plugins/wpcom-member/• wordpress / composer / npm:
wp plugin list --status=all | grep wpcom-member• wordpress / composer / npm:
wp plugin update wpcom-member --alldisclosure
漏洞利用状态
EPSS
0.71% (72% 百分位)
CISA SSVC
CVSS 向量
The primary mitigation is to upgrade the WPCOM Member plugin to a version containing the fix. If immediate upgrading is not possible due to compatibility issues or breaking changes, consider temporarily disabling SMS login functionality. Implement strict access controls and monitor user activity for suspicious logins. Review WordPress security plugins for potential detection rules related to unusual login attempts. After upgrade, verify the fix by attempting an SMS login with a non-administrator account and confirming access is denied.
将 WPCOM Member 插件更新到最新可用版本以修复身份验证绕过漏洞。确保短信登录已正确配置，并采取额外的安全措施来保护用户帐户。
漏洞分析和关键警报直接发送到您的邮箱。
CVE-2025-1475 is a critical vulnerability in the WPCOM Member WordPress plugin allowing attackers to bypass authentication and log in as any user, including administrators, if SMS login is enabled.
If you are using the WPCOM Member plugin for WordPress in versions 0.0.0 through 1.7.5 and have SMS login enabled, you are likely affected by this vulnerability.
Upgrade the WPCOM Member plugin to a patched version. If upgrading is not immediately possible, disable SMS login as a temporary workaround.
While active exploitation is not yet confirmed, the CRITICAL severity and public disclosure suggest a high probability of exploitation. Monitor for suspicious activity.
Refer to the official WPCOM security advisory for details and updates regarding this vulnerability. Check the Automattic security blog for the latest information.
上传你的依赖文件，立即了解此CVE和其他CVE是否影响你。