CVE-2025-7955: RingCentral Communications 1.5 - 1.6.8 - Missing Server‑Side Verification to Authentication Bypass via ringcentral_admin_login_2fa_verify Function
Published Aug 28, 2025
·Updated
The RingCentral Communications plugin for WordPress is vulnerable to Authentication Bypass due to improper validation within the ringcentraladminlogin2faverify() function in versions 1.5 to 1.6.8. This makes it possible for unauthenticated attackers to log in as any user simply by supplying identical bogus codes.
Affected Software
1 affected component
RingCentral Communications>=1.5<=1.6.8
Event History
Aug 28, 2025
CVE Published
via MITRE·05:24 AM
Data Sourced
via MITRE·05:24 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·06:15 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-7955?
CVE-2025-7955 is classified as a high severity vulnerability due to its authentication bypass nature.
2
How do I fix CVE-2025-7955?
To fix CVE-2025-7955, update the RingCentral Communications plugin for WordPress to version 1.6.9 or later.
3
Which versions of RingCentral Communications are affected by CVE-2025-7955?
CVE-2025-7955 affects RingCentral Communications plugin versions 1.5 to 1.6.8.
4
What type of vulnerability is described in CVE-2025-7955?
CVE-2025-7955 describes an authentication bypass vulnerability.
5
Can unauthenticated attackers exploit CVE-2025-7955?
Yes, unauthenticated attackers can exploit CVE-2025-7955 to log in as any user.