PT-2026-146420

CVE-2026-123711

Published

2026-11-13

Updated

2026-11-13

Description by

CVSS 3.1

8.1

High

MetricsAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WPCOM Member WordPress plugin versions prior to 1.8.3

Description When WeChat official-account keyword login is enabled, the plugin fails to limit or bind attempts to verify WeChat login codes. This allows unauthenticated attackers to brute-force a code issued to another user and gain unauthorized access to their account, including those with administrator privileges.

Recommendations Update WPCOM Member WordPress plugin to version 1.8.3 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Aabideen Bangash

Vendors

Affected products

Weakness enumeration

CWE-287: Improper Authentication

Related identifiers