CVE-2025-14002

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14002", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-04T02:28:05.914Z", "datePublished": "2025-12-16T09:20:09.768Z", "dateUpdated": "2026-04-08T16:51:56.535Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:51:56.535Z"}, "affected": [{"vendor": "whyun", "product": "WPCOM Member", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.7.16", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WPCOM Member plugin for WordPress is vulnerable to authentication bypass via brute force in all versions up to, and including, 1.7.16. This is due to weak OTP (One-Time Password) generation using only 6 numeric digits combined with a 10-minute validity window and no rate limiting on verification attempts. This makes it possible for unauthenticated attackers to brute-force the verification code and authenticate as any user, including administrators, if they know the target's phone number, and the target does not notice or ignores the SMS notification with the OTP."}], "title": "WPCOM Member <= 1.7.16 - Authentication Bypass via Weak OTP", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4f02ee56-40bd-4132-92e1-e2897ff2a4c4?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wpcom-member/tags/1.7.16/includes/class-sesstion.php#L29"}, {"url": "https://plugins.trac.wordpress.org/browser/wpcom-member/tags/1.7.16/includes/member-functions.php#L833"}, {"url": "https://plugins.trac.wordpress.org/changeset/3411048/wpcom-member"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-287 Improper Authentication", "cweId": "CWE-287", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "wesley"}], "timeline": [{"time": "2025-12-04T02:46:19.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-12-15T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-16T14:53:17.600365Z", "id": "CVE-2025-14002", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-16T14:58:11.381Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14002", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-12-16T14:53:17.600365Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-16T14:57:05.380Z"}}], "cna": {"title": "WPCOM Member <= 1.7.16 - Authentication Bypass via Weak OTP", "credits": [{"lang": "en", "type": "finder", "value": "wesley"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "whyun", "product": "WPCOM Member", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.7.16"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-04T02:46:19.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-12-15T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4f02ee56-40bd-4132-92e1-e2897ff2a4c4?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wpcom-member/tags/1.7.16/includes/class-sesstion.php#L29"}, {"url": "https://plugins.trac.wordpress.org/browser/wpcom-member/tags/1.7.16/includes/member-functions.php#L833"}, {"url": "https://plugins.trac.wordpress.org/changeset/3411048/wpcom-member"}], "descriptions": [{"lang": "en", "value": "The WPCOM Member plugin for WordPress is vulnerable to authentication bypass via brute force in all versions up to, and including, 1.7.16. This is due to weak OTP (One-Time Password) generation using only 6 numeric digits combined with a 10-minute validity window and no rate limiting on verification attempts. This makes it possible for unauthenticated attackers to brute-force the verification code and authenticate as any user, including administrators, if they know the target's phone number, and the target does not notice or ignores the SMS notification with the OTP."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287 Improper Authentication"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:51:56.535Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14002", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:51:56.535Z", "dateReserved": "2025-12-04T02:28:05.914Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-16T09:20:09.768Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WPCOM Member", "vendor": "whyun", "versions": [{"lessThanOrEqual": "1.7.16", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WPCOM Member plugin for WordPress is vulnerable to authentication bypass via brute force in all versions up to, and including, 1.7.16. This is due to weak OTP (One-Time Password) generation using only 6 numeric digits combined with a 10-minute validity window and no rate limiting on verification attempts. This makes it possible for unauthenticated attackers to brute-force the verification code and authenticate as any user, including administrators, if they know the target's phone number, and the target does not notice or ignores the SMS notification with the OTP."}], "id": "CVE-2025-14002", "lastModified": "2026-06-17T08:35:08.850", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14002", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-12-16T14:53:17.600365Z", "version": "2.0.3"}}]}, "published": "2025-12-16T10:15:42.583", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wpcom-member/tags/1.7.16/includes/class-sesstion.php#L29"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wpcom-member/tags/1.7.16/includes/member-functions.php#L833"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3411048/wpcom-member"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4f02ee56-40bd-4132-92e1-e2897ff2a4c4?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T17:04:31.333489+00:00", "value": {"mitigation_remediation": ["Upgrade the WPCOM Member plugin to the latest available release that addresses the OTP vulnerability.", "If a patch is not immediately available, configure stricter rate limiting on OTP verification requests or temporarily disable the OTP flow until a secure implementation is deployed.", "Implement additional multi\u2011factor authentication (e.g., time\u2011based one\u2011time passwords or hardware tokens) to reduce reliance on the weak numeric OTP.", "Verify that the plugin\u2019s source code no longer generates a 6\u2011digit numeric OTP and removes the 10\u2011minute window without cryptographic randomness; if uncomfortable, consider removing or disabling the member module entirely until a secure version is released."], "summary": {"action": "Immediate Patch", "impact": "Authentication Bypass"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the whyun WPCOM Member plugin for WordPress. All released versions up to and including 1.7.16 are impacted. Users running these versions should check the plugin\u2019s changelog or contact the vendor for an updated release that addresses the OTP weakness.", "description_and_impact": "The WPCOM Member plugin for WordPress is vulnerable to an authentication bypass because its OTP generation is weak, using only six numeric digits combined with a ten\u2011minute validity window and no rate limiting on verification attempts. An attacker who knows a target\u2019s phone number can brute\u2011force the OTP, thereby authenticating as that user, including administrators, if the target does not notice or ignores the SMS notification.", "risk_and_exploitability": "The CVSS score of 8.1 indicates a high severity. The EPSS score is under 1%, suggesting low exploitation probability in the wild, and the CVE is not listed in the CISA KEV catalog. Based on the description, the attack vector is remote: an unauthenticated attacker can repeatedly submit OTP verification requests over the network. Because each attempt requires only a 6\u2011digit numeric code and there is no rate limiting, brute\u2011forcing succeeds within the 10\u2011minute validity period. If successful, the attacker gains full access to the target account, potentially including administrator rights, thereby compromising confidentiality, integrity, and availability of the WordPress site."}}}}, "created": "2025-12-16T17:08:37.076101+00:00", "updated": "2026-04-21T17:15:25.328562+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress", "wpcom", "wpcom$PRODUCT$wpcom_member"]}