Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Vendor: whyun Clear all filters
TI-2026-70265 CVE-2026-104803 · GHSA-gj32-ffvm-frj6

Authentication bypass in WPCOM Member plugin social-login callback

Priority MEDIUM 49

The WPCOM Member plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.7.27 via the `uuid` and `code` parameters of the social-login callback handler registered on the `init`…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00449 Published 2026-10-10 No fix listed CWE-287
TI-2025-12793 CVE-2025-14002 · GHSA-8vh6-v9pf-9wpq

WPCOM Member <= 1.7.16 - Authentication Bypass via Weak OTP

Priority LOW 38

The WPCOM Member plugin for WordPress is vulnerable to authentication bypass via brute force in all versions up to, and including, 1.7.16.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00506 Published 2025-12-16 No fix listed CWE-287
TI-2025-01268 CVE-2025-1475 · GHSA-hrhc-cx9f-g4q6

WPCOM Member <= 1.7.5 - Authentication Bypass via 'user_phone'

Priority MEDIUM 50

The WPCOM Member plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.7.5.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00647 Published 2025-03-07 No fix listed CWE-287