The WPCOM Member plugin for WordPress is affected by a time‑based SQL injection flaw that originates from the unchecked user_phone parameter. Because the plugin concatenates this value directly into SQL statements without proper escaping or query preparation, an attacker able to control the value can inject additional SQL clauses. The vulnerability allows unauthenticated users to execute SQL commands that can read or manipulate sensitive information stored in the database. This type of flaw is a classic input‑validation weakness identified as CWE‑89.

Affected systems include installations of the WPCOM Member plugin on WordPress sites that are running any version up to and including 1.7.6. The plugin version 1.7.6 and earlier expose the user_phone field to injection, regardless of user authentication status. WordPress itself is not directly vulnerable; the issue resides only within the plugin code.

The CVSS score of 7.5 indicates high impact, and the EPSS rating of 24% suggests a significant exploitation likelihood. The flaw is not listed in CISA KEV, but it is active and can be triggered remotely by supplying a crafted user_phone value in an HTTP request. Attackers can embed time‑delaying expressions to confirm the injection and harvest data without immediate detection.