WordPress plugin
WPCOM Member security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 9 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical4
- High4
- Medium1
- Low0
All WPCOM Member vulnerabilities
Nothing in this view
No vulnerabilities match this filter. Show all.
WPCOM Member: common questions
Does WPCOM Member have known vulnerabilities?
Yes. VulnCrest Radar lists 9 known vulnerabilities in WPCOM Member: 4 critical, 4 high, 1 medium. None are known to affect version null.
How do I check which version of WPCOM Member I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent WPCOM Member vulnerability?
CVE-2026-104803, published Oct 9, 2026: WPCOM Member <= 1.7.27 - Unauthenticated Authentication Bypass via 'uuid' and 'code' Parameters on Social-Login Callback. Severity: Critical (CVSS 9.8).
Is any WPCOM Member vulnerability listed in CISA KEV?
No. None of the known WPCOM Member vulnerabilities is currently listed in the CISA KEV catalog.