WordPress plugin
WPCOM Member security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 9 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical4
- High4
- Medium1
- Low0
All WPCOM Member vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Critical9.8 | Unauthenticated Authentication Bypass via 'uuid' and 'code' Parameters on Social-Login Callback ≤1.7.27Update to 1.8.0 | CVE-2026-104803 | |
| High8.1 | Authentication Bypass via Weak OTP ≤1.7.16Update to 1.7.17 | CVE-2025-14002 | |
| High8.8 | Authenticated (Contributor+) Local File Inclusion via Shortcode ≤1.7.14Update to 1.7.15 | CVE-2025-11920 | |
| High8.8 | Authenticated (Contributor+) Local File Inclusion ≤1.7.7Update to 1.7.8 | CVE-2025-39570 | |
| High7.5 | Unauthenticated Time-Based SQL Injection ≤1.7.6Update to 1.7.7 | CVE-2025-2221 | |
| Critical9.8 | Authentication Bypass via 'user_phone' ≤1.7.5Update to 1.7.6 | CVE-2025-1475 | |
| Critical9.8 | Unauthenticated Privilege Escalation via User Meta ≤1.5.2.1Update to 1.5.3 | CVE-2024-7493 | |
| Critical10.0 | Injected Backdoor 4.4.6.4 – 4.4.7.1Update to 4.4.7.3 | CVE-2024-6297 |
- Critical9.8Unauthenticated Authentication Bypass via 'uuid' and 'code' Parameters on Social-Login Callback
≤1.7.27Update to 1.8.0
- High8.1Authentication Bypass via Weak OTP
≤1.7.16Update to 1.7.17
- High8.8Authenticated (Contributor+) Local File Inclusion via Shortcode
≤1.7.14Update to 1.7.15
- High8.8Authenticated (Contributor+) Local File Inclusion
≤1.7.7Update to 1.7.8
- High7.5Unauthenticated Time-Based SQL Injection
≤1.7.6Update to 1.7.7
- Critical9.8Authentication Bypass via 'user_phone'
≤1.7.5Update to 1.7.6
- Critical9.8Unauthenticated Privilege Escalation via User Meta
≤1.5.2.1Update to 1.5.3
- Critical10.0Injected Backdoor
4.4.6.4 – 4.4.7.1Update to 4.4.7.3
WPCOM Member: common questions
Does WPCOM Member have known vulnerabilities?
Yes. VulnCrest Radar lists 9 known vulnerabilities in WPCOM Member: 4 critical, 4 high, 1 medium. None are known to affect version null.
How do I check which version of WPCOM Member I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent WPCOM Member vulnerability?
CVE-2026-104803, published Oct 9, 2026: WPCOM Member <= 1.7.27 - Unauthenticated Authentication Bypass via 'uuid' and 'code' Parameters on Social-Login Callback. Severity: Critical (CVSS 9.8).
Is any WPCOM Member vulnerability listed in CISA KEV?
No. None of the known WPCOM Member vulnerabilities is currently listed in the CISA KEV catalog.