CVE-2026-123711: WPCOM Member < 1.8.3 - Unauthenticated Account Takeover via WeChat Login Code Brute-Force
The WPCOM Member WordPress plugin before 1.8.3 does not limit or bind attempts to verify WeChat login codes, allowing unauthenticated attackers to brute-force a code issued to another user and log in as that user, including administrators, when WeChat official-account keyword login is enabled.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WPCOM Memberto a version that resolves this vulnerability.Fixed in 1.8.3
Event History
Frequently Asked Questions
Which deployments are exposed to account takeover?
WPCOM Member installations before 1.8.3 are exposed when WeChat official-account keyword login is enabled. Any account that receives a login code, including an administrator account, may be targeted.
What does an attacker need to exploit this issue?
The attacker does not need to authenticate to the WordPress site. They need to brute-force a WeChat login code issued to the account they want to access.
How can I tell whether my site is affected?
Check whether WPCOM Member is below version 1.8.3 and whether WeChat official-account keyword login is enabled. If both conditions apply, the described code-verification weakness affects the site.