The WPCOM Member plugin for WordPress is vulnerable to an authentication bypass because its OTP generation is weak, using only six numeric digits combined with a ten‑minute validity window and no rate limiting on verification attempts. An attacker who knows a target’s phone number can brute‑force the OTP, thereby authenticating as that user, including administrators, if the target does not notice or ignores the SMS notification.

The vulnerability affects the whyun WPCOM Member plugin for WordPress. All released versions up to and including 1.7.16 are impacted. Users running these versions should check the plugin’s changelog or contact the vendor for an updated release that addresses the OTP weakness.

The CVSS score of 8.1 indicates a high severity. The EPSS score is under 1%, suggesting low exploitation probability in the wild, and the CVE is not listed in the CISA KEV catalog. Based on the description, the attack vector is remote: an unauthenticated attacker can repeatedly submit OTP verification requests over the network. Because each attempt requires only a 6‑digit numeric code and there is no rate limiting, brute‑forcing succeeds within the 10‑minute validity period. If successful, the attacker gains full access to the target account, potentially including administrator rights, thereby compromising confidentiality, integrity, and availability of the WordPress site.