The WPCOM Member plugin for WordPress contains an authentication bypass flaw that stems from the plugin’s failure to properly validate the 'user_phone' parameter during login. When an attacker supplies an arbitrary phone number, the plugin accepts it as a valid credential and authenticates the request as the user associated with that number. This allows an attacker to impersonate any registered account, including administrators, without needing a password. The weakness is an authentication failure (CWE‑287) and it provides the attacker with full access to the site’s content, files, and potentially sensitive data.

WordPress sites that use the whyun WPCOM Member plugin version 1.7.5 or earlier are affected. All installations that have not updated beyond 1.7.5 and that have SMS login enabled are at risk.

The vulnerability receives a CVSS score of 9.8, classifying it as critical. The EPSS score of less than 1% suggests that, in the current window, the probability of exploitation is low, and it is not listed in the CISA KEV catalog. Nonetheless, the attack vector is straightforward: a remote authenticated request to the login endpoint with a crafted 'user_phone' value. An attacker only needs network access to the site and the ability to send HTTP requests. Should the service allow SMS login, the attacker can simply supply any phone number that belongs to a registered user to gain full access.