dbcve.org
Improper AuthenticationWeakness · CWE-287

CVE-2025-14002

HIGH · 8.1 CVSS v3.1 Published 2025-12-16
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
90/100
Remediation priority · Urgent
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
The WPCOM Member plugin for WordPress is vulnerable to authentication bypass via brute force in all versions up to, and including, 1.7.16. This is due to weak OTP (One-Time Password) generation using only 6 numeric digits combined with a 10-minute validity window and no rate limiting on verification attempts. This makes it possible for unauthenticated attackers to brute-force the verification code and authenticate as any user, including administrators, if they know the target's phone number, and the target does not notice or ignores the SMS notification with the OTP.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

The WPCOM Member WordPress plugin has an authentication bypass vulnerability due to weak OTP implementation. Attackers can brute-force 6-digit numeric OTPs (1 million combinations) within the 10-minute validity window because no rate limiting exists on verification attempts, allowing unauthorized access to any user account including administrators if the phone number is known.

MitigationApply vendor patch immediately; until available, disable the plugin or implement interim rate limiting at the web application firewall (WAF) layer to block repeated OTP verification attempts.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Confirm WPCOM Member plugin installation and version
    Navigate to WordPress admin dashboard > Plugins > Installed Plugins. Locate 'WPCOM Member' in the list and note the version number displayed. Alternatively, check the plugin files in /wp-content/plugins/ for a version marker in the main plugin file header.
    Affected if The plugin is installed and the version has not been patched to address the OTP brute-force vulnerability (compare your version to the latest available from the vendor).
  2. Verify if phone/OTP login feature is enabled
    Access the plugin settings page in WordPress admin (usually under Settings > WPCOM Member or a dedicated WPCOM menu). Look for options related to 'phone login', 'mobile login', 'OTP login', or 'two-factor authentication' and check whether any of these features are turned on.
    Affected if Phone number or OTP-based login is enabled in the plugin settings, making the authentication bypass reachable.
  3. Inspect OTP verification endpoint for rate limiting
    Examine the plugin configuration files or .htaccess/nginx configuration for any rate-limit rules on endpoints related to OTP verification (commonly URLs containing 'otp', 'verify', 'login/code', or 'sms'). Check if the web server or a security plugin enforces attempts-per-minute limits on these endpoints.
    Affected if No rate limiting, throttling, or brute-force protection is configured on the OTP verification endpoint, allowing unlimited attempts within the 10-minute window.
  4. Check login attempt protection at application level
    Review any security or firewall plugins (such as Wordfence, Sucuri, iThemes Security) for login brute-force protection settings. Verify whether login attempt limits are applied to the OTP verification process specifically, not just to password-based logins.
    Affected if The environment lacks application-layer protection limiting OTP verification attempts, enabling the full 1 million combination brute force.

A user is affected if the WPCOM Member plugin is installed with OTP/phone login enabled and no rate limiting exists on the OTP verification mechanism, allowing attackers to brute-force the 6-digit code within the validity window.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Apply vendor patch immediately; until available, disable the plugin or implement interim rate limiting at the web application firewall (WAF) layer to block repeated OTP verification attempts.

Recommended fix High confidence

WPCOM Member version 1.7.17 or later

  1. Update the WPCOM Member plugin to version 1.7.17 or later through the WordPress admin dashboard under Plugins > All Plugins > WPCOM Member > Update Now
  2. Verify the update was successfully applied by checking the plugin version in the installed plugins list
  3. Confirm that the new version includes improved OTP generation with stronger entropy and rate limiting on verification attempts

Generated from the published advisory — verify against the referenced sources before acting.

Have this fixed Scoped from the published advisory
  • Consultation4.0 h
  • Implementation12.0 h
  • Testing6.0 h
  • Review / QA3.0 h
25.0 hours of engineering $4,400
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $7,040.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2025-14002 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2025-14002 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data