High · published November 1, 2025
⚡ Authenticated users with Contributor-level access can exploit this Local File Inclusion vulnerability in the WPCOM Member plugin, allowing them to execute arbitrary PHP files on your server! 😱 Think of it like a restaurant where the staff can order off the menu but somehow can also access the kitchen — if they can sneak in their own recipe, they could end up serving their own dish instead of yours! This vulnerability could lead to an attacker executing any PHP code they want, potentially bypassing your access controls and exposing sensitive data. Imagine someone sneaking in the kitchen and changing the entire menu — this could be absolutely devastating for your site!
Think of it like a restaurant where the staff can order off the menu but somehow can also access the kitchen — if they can sneak in their own recipe, they could end up serving their own dish instead of yours! The vulnerability arises from the action parameter in one of the shortcodes, which allows authenticated attackers to include and execute arbitrary .php files from the server, compromising the security of your WordPress site.
This vulnerability could lead to an attacker executing any PHP code they want, potentially bypassing your access controls and exposing sensitive data. Imagine someone sneaking in the kitchen and changing the entire menu — this could be absolutely devastating for your site! Update the WPCOM Member plugin to version 1.7.15 or later immediately to close this vulnerability. Additionally, review user roles and permissions to ensure that only trusted users have access to Contributor-level capabilities. You've got this! With a quick update and a bit of vigilance, you'll have your site locked down in no time! 🛡️