Critical · published March 7, 2025
🚨 An unauthenticated attacker can log in as any user, including administrators, with a simple SMS authentication bypass! 🔥 Think of it like a restaurant where anyone can stroll in and claim to be a VIP guest, just because they have a reservation number — no ID required! If the security checks are too lax, chaos can follow. This is absolutely devastating! An attacker could gain unfettered access to sensitive site management areas, change settings, view personal user data, or even lock out legitimate users. The potential for data breaches and site corruption is enormous—this flaw simply cannot be ignored!
Think of it like a restaurant where anyone can stroll in and claim to be a VIP guest, just because they have a reservation number — no ID required! If the security checks are too lax, chaos can follow. The WPCOM Member plugin for WordPress lacks proper verification of the 'user_phone' parameter during login attempts. This allows unauthorized users to authenticate as any existing user if SMS login is enabled, making it a significant security hole.
This is absolutely devastating! An attacker could gain unfettered access to sensitive site management areas, change settings, view personal user data, or even lock out legitimate users. The potential for data breaches and site corruption is enormous—this flaw simply cannot be ignored! Update the WPCOM Member plugin immediately to version 1.7.6 or later. Review your user authentication settings—consider disabling SMS login temporarily until remediation is complete. Lastly, audit user accounts for any unauthorized access. You've got this! With these steps, you can secure your site and protect your users like the security hero you are! 🛡️