Plugin icon

WPCOM Member

wpcom-member

Vulnerabilities:

7

Last Updated:

July 3, 2026

Active Installs:

1000

Published
Title
Fixed in
CVSS
Published
2025-12-15
Title
WPCOM Member < 1.7.17 - Authentication Bypass via Weak OTP
Fixed in
Fixed in 1.7.17
CVSS
8.1 (high)
Published
2025-10-31
Title
WPCOM Member < 1.7.15 - Authenticated (Contributor+) Local File Inclusion via Shortcode
Fixed in
Fixed in 1.7.15
CVSS
8.8 (high)
Published
2025-04-16
Title
WPCOM Member < 1.7.8 - Authenticated (Contributor+) Local File Inclusion
Fixed in
Fixed in 1.7.8
CVSS
8.8 (high)
Published
2025-03-13
Title
WPCOM Member < 1.7.7 - Unauthenticated Time-Based SQL Injection
Fixed in
Fixed in 1.7.7
CVSS
7.5 (high)
Published
2025-03-06
Title
WPCOM Member < 1.7.6 - Authentication Bypass via 'user_phone'
Fixed in
Fixed in 1.7.6
CVSS
9.8 (critical)
Published
2024-09-30
Title
WPCOM Member < 1.5.4.1 - Reflected Cross-Site Scripting
Fixed in
Fixed in 1.5.4.1
CVSS
6.1 (medium)
Published
2024-09-06
Title
WPCOM Member < 1.5.3 - Unauthenticated Privilege Escalation via User Meta
Fixed in
Fixed in 1.5.3
CVSS
9.8 (critical)