What’s Vulnerable › Products

whyun WPCOM Member vulnerabilities

8 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.

Check whether your whyun WPCOM Member version is affected

Latest whyun WPCOM Member vulnerabilities

• CVE-2026-104803 — WPCOM Member <= 1.7.27 - Unauthenticated Authentication Bypass via 'uuid' and 'code' Parameters on Social-Login Callback (CVSS 9.8)
• CVE-2025-14002 — WPCOM Member <= 1.7.16 - Authentication Bypass via Weak OTP (CVSS 8.1)
• CVE-2025-11920 — WPCOM Member <= 1.7.14 - Authenticated (Contributor+) Local File Inclusion via Shortcode (CVSS 8.8)
• CVE-2025-39570 — WordPress WPCOM Member plugin <= 1.7.7 - Local File Inclusion Vulnerability (CVSS 8.8)
• CVE-2025-2221 — WPCOM Member <= 1.7.6 - Unauthenticated Time-Based SQL Injection (CVSS 7.5)
• CVE-2025-1475 — WPCOM Member <= 1.7.5 - Authentication Bypass via 'user_phone' (CVSS 9.8)
• CVE-2024-47378 — WordPress WPCOM Member plugin <= 1.5.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 6.1)
• CVE-2024-7493 — WPCOM Member <= 1.5.2.1 - Unauthenticated Privilege Escalation via User Meta (CVSS 9.8)