High · published December 16, 2025
⚡ A brute-force party awaits! The WPCOM Member plugin for WordPress is vulnerable to authentication bypass, and it's like leaving the front door wide open for anyone who knows a phone number! Imagine a security system that only requires a 6-digit code to unlock the door, and you can try as many times as you want without any guardrails — that’s exactly what's happening here! With no rate limiting, any determined intruder can guess their way in while the homeowners are blissfully unaware. An attacker can easily authenticate as any user, including admins, if they know the target's phone number. This means they could gain access to sensitive information, alter settings, or even wreak havoc on the entire site! The implications could be absolutely devastating for both individuals and businesses alike.
Imagine a security system that only requires a 6-digit code to unlock the door, and you can try as many times as you want without any guardrails — that’s exactly what's happening here! With no rate limiting, any determined intruder can guess their way in while the homeowners are blissfully unaware. The flaw is due to weak OTP generation that uses only 6 numeric digits with a 10-minute validity window and lacks rate limiting for verification attempts. This allows unauthenticated attackers to brute-force OTPs and bypass authentication altogether.
An attacker can easily authenticate as any user, including admins, if they know the target's phone number. This means they could gain access to sensitive information, alter settings, or even wreak havoc on the entire site! The implications could be absolutely devastating for both individuals and businesses alike. Immediately update the WPCOM Member plugin to version 1.7.17 or later to patch this vulnerability. Additionally, consider implementing rate limiting on OTP attempts and explore stronger OTP generation methods to enhance security. You've got this! With these steps, you'll be shoring up your defenses in no time! 🛡️