WPCOM Member Authentication Bypass Vulnerability via 'user_phone' Parameter

A vulnerability allowing authentication bypass has been identified in the WPCOM Member plugin for WordPress, affecting all versions through 1.7.5. The issue arises from inadequate validation of the 'user_phone' parameter during the login process. This flaw enables unauthenticated attackers to log in as any existing user, including administrators, if SMS login is activated.

Impact

Exploitation of this vulnerability allows for unauthorized access to user accounts, potentially including administrative accounts, depending on the targeted user.

Reproduction

To reproduce this vulnerability, send a login request to the WordPress site with the 'user_phone' parameter. If SMS login is enabled, the request will bypass authentication and log in as the user associated with the phone number, regardless of whether the attacker has permission to access that account.

Remediation

Users are advised to update the WPCOM Member plugin to version 1.7.6 or later.