CVE-2025-14002: 
WordPress vulnerability analysis and mitigation

CVE-2025-14002 is an authentication bypass vulnerability in the WPCOM Member plugin for WordPress, exploitable via brute-forcing a weak One-Time Password (OTP). All versions up to and including 1.7.16 are affected. The vulnerability was published on December 16, 2025, with the assigner being Wordfence. It carries a CVSS v3.1 base score of 8.1 (High) (Wordfence/EUVD, Red Hat).

The root cause is classified as CWE-287 (Improper Authentication). The plugin generates OTPs using only 6 numeric digits (a keyspace of 1,000,000 possibilities), with a 10-minute validity window and no rate limiting on verification attempts — making exhaustive brute-force attacks feasible within the OTP's lifetime. An unauthenticated attacker who knows a target user's phone number can trigger an OTP SMS, then systematically enumerate all possible codes against the verification endpoint until authentication succeeds. Relevant source code is visible in the plugin's tracked files at includes/class-sesstion.php and includes/member-functions.php (Wordfence, Plugin Trac).

Successful exploitation allows an unauthenticated attacker to authenticate as any WordPress user, including site administrators, resulting in full confidentiality, integrity, and availability compromise of the affected WordPress installation. An attacker gaining administrator access can install malicious plugins, create backdoor accounts, exfiltrate sensitive site data, or deface the site. The only prerequisite is knowledge of the target user's phone number, and the attack is invisible to the victim unless they notice the unsolicited OTP SMS (Wordfence, The Hacker Wire).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly Executive Summary). The EPSS score is approximately 0.0015 (0.15%), indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack is conceptually straightforward and requires no special privileges or tooling beyond the ability to send HTTP requests.

1. Reconnaissance: Identify WordPress sites using the WPCOM Member plugin (version ≤1.7.16) via passive scanning, WordPress plugin enumeration tools (e.g., WPScan), or by inspecting publicly visible plugin metadata.
2. Obtain target phone number: Gather the phone number of a target user (e.g., administrator) through OSINT, social engineering, or data leaks, as the plugin uses phone-based OTP authentication.
3. Trigger OTP generation: Send a login/authentication request to the WPCOM Member plugin's OTP endpoint for the target user's phone number, causing the plugin to generate and SMS a 6-digit OTP to the target.
4. Brute-force OTP: Rapidly enumerate all 1,000,000 possible 6-digit codes (000000–999999) against the plugin's OTP verification endpoint using an automated script or tool (e.g., a Python script with requests), exploiting the absence of rate limiting.
5. Authenticate as target: Upon finding the correct OTP (within the 10-minute validity window), the attacker is authenticated as the target user — including as an administrator if that account was targeted.
6. Post-exploitation: With administrator access, install a web shell via a malicious plugin, create a persistent backdoor account, exfiltrate data, or perform other privileged actions on the WordPress site (Wordfence, Plugin Trac).

• Network: High volume of rapid, sequential HTTP requests to the WPCOM Member OTP verification endpoint from a single IP or small IP range within a short time window; unusual authentication requests for administrator accounts.
• Logs: WordPress access logs showing hundreds or thousands of OTP verification attempts in rapid succession (within minutes) for the same user account; successful login events immediately following a burst of failed OTP attempts.
• File System: Unexpected new plugin directories or PHP files in wp-content/plugins/ or wp-content/uploads/ following a suspicious authentication event; new or modified wp-config.php.
• Process/Behavior: New WordPress administrator accounts created without corresponding legitimate user activity; unexpected changes to site settings, installed plugins, or themes shortly after an anomalous login event (Wordfence).

The primary remediation is to update the WPCOM Member plugin to a version beyond 1.7.16, which includes a patch for this vulnerability (changeset available at the WordPress plugin repository) (Plugin Changeset). If immediate patching is not possible, consider temporarily deactivating the plugin to eliminate the attack surface. Additional hardening measures include implementing a Web Application Firewall (WAF) rule to rate-limit requests to OTP verification endpoints, monitoring authentication logs for brute-force patterns, and enforcing stronger MFA mechanisms where possible (Wordfence, Feedly Executive Summary).

Wordfence, the assigning CNA, published the vulnerability details and a threat intelligence entry covering the technical root cause and impact (Wordfence). The Hacker Wire published a dedicated article on the authentication bypass (The Hacker Wire). RedPacket Security and CISA's weekly vulnerability bulletin for the week of December 15, 2025 also referenced the CVE, indicating routine community tracking but no significant alarm or widespread discussion (CISA Bulletin). Wordfence's weekly WordPress vulnerability report (December 15, 2025 – January 4, 2026) included this CVE in its roundup (Wordfence Blog).