CVE-2025-11920: WPCOM Member WordPress Plugin RCE Flaw

CVE-2025-11920 Overview

CVE-2025-11920 is a Local File Inclusion (LFI) vulnerability affecting the WPCOM Member plugin for WordPress in all versions up to and including 1.7.14. The flaw resides in the action parameter of one of the plugin's shortcodes, which fails to validate user-supplied input before passing it to a file inclusion function. Authenticated attackers with Contributor-level access or higher can include and execute arbitrary .php files on the server.

Critical Impact
Authenticated attackers can execute arbitrary PHP code, bypass access controls, exfiltrate sensitive data, and achieve full code execution on vulnerable WordPress sites where .php files can be uploaded and included.

Affected Products

WPCOM Member plugin for WordPress, versions ≤ 1.7.14
WordPress installations using the plugin with Contributor-level or higher accounts enabled
Multi-author WordPress sites accepting user registrations with author privileges

Discovery Timeline

2025-11-01 - CVE-2025-11920 published to the National Vulnerability Database (NVD)
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-11920

Vulnerability Analysis

The vulnerability is classified under [CWE-98]: Improper Control of Filename for Include/Require Statement in PHP Program. The WPCOM Member plugin exposes a shortcode handler that accepts an action parameter from user-controlled input. This parameter is concatenated into a file path and passed to a PHP include or require statement without proper sanitization or whitelisting.

Referenced source lines in class-member.php (lines 374, 1119, and 1171) demonstrate where the unsafe inclusion logic resides. Because shortcodes can be embedded in posts authored by Contributor-level users, any account with publish-draft permissions can trigger the vulnerable code path. The fix was committed in WordPress Plugin Changeset 3385562.

Root Cause

The root cause is missing input validation on the action shortcode attribute. The plugin treats the parameter as a trusted file identifier and constructs an inclusion path directly from it. Without an allowlist of permitted action names or path normalization, attackers can supply traversal sequences or absolute paths to include arbitrary .php files on the local filesystem.

Attack Vector

An authenticated Contributor crafts a WordPress post containing the vulnerable shortcode with a malicious action value. When the shortcode is rendered, the plugin includes the attacker-specified PHP file. If the attacker can place a .php payload anywhere readable by the web server, such as uploaded media or temporary files, the included file executes with the privileges of the PHP worker process. See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-11920

Indicators of Compromise

Unexpected .php files appearing in wp-content/uploads/ or other writable directories
WordPress posts authored by Contributor accounts containing the WPCOM Member shortcode with unusual action parameter values
PHP error log entries referencing include() or require() failures on paths under user control
Outbound network connections originating from the PHP-FPM process to unexpected destinations

Detection Strategies

Audit WordPress access logs for POST requests to admin-ajax.php or shortcode preview endpoints containing action= values with path separators or .. sequences
Inspect the WordPress posts and postmeta tables for shortcode patterns referencing the WPCOM Member plugin with non-standard parameters
Scan the WPCOM Member plugin directory and compare file hashes against the patched 1.7.15 or later release

Monitoring Recommendations

Enable WordPress file integrity monitoring on the plugin directory and wp-content/uploads/
Forward web server and PHP error logs to a centralized logging platform for query and correlation
Alert on PHP processes spawning shell interpreters, network utilities, or downloaders

How to Mitigate CVE-2025-11920

Immediate Actions Required

Update the WPCOM Member plugin to a version newer than 1.7.14 as soon as the patched release is published by the vendor
Audit all Contributor, Author, and Editor accounts; remove or disable any accounts that are not actively required
Restrict file upload MIME types and disable PHP execution in wp-content/uploads/ via web server configuration
Review recent posts authored by lower-privileged users for malicious shortcodes

Patch Information

The vendor addressed the issue in WordPress Plugin Changeset 3385562. Site administrators should upgrade to the latest available release of the WPCOM Member plugin and verify the installed version against the WordPress plugin repository.

Workarounds

Deactivate the WPCOM Member plugin until the patched version is installed
Deploy a Web Application Firewall (WAF) rule blocking requests containing path traversal sequences in the action parameter
Set open_basedir in php.ini to restrict PHP file access to the WordPress document root
Disable PHP execution in upload directories using Apache or Nginx configuration

bash

# Nginx: deny PHP execution within wp-content/uploads
location ~* /wp-content/uploads/.*\.php$ {
    deny all;
    return 403;
}

# Apache: equivalent restriction via .htaccess in uploads directory
# <FilesMatch "\.php$">
#     Require all denied
# </FilesMatch>