CVE-2025-7955

9.8 criticalEPSS 0.7%

Critical (9.8). EPSS 0.7% chance of exploitation in the next 30 days.

The RingCentral Communications plugin for WordPress is vulnerable to Authentication Bypass due to improper validation within the ringcentral_admin_login_2fa_verify() function in versions 1.5 to 1.6.8. This makes it possible for unauthenticated attackers to log in as any user simply by supplying identical bogus codes.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 54% of CVEs (scores of 2026-10-31)
CWE: CWE-287
Published: 2025-08-28
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://plugins.trac.wordpress.org/browser/rccp-free/tags/1.6.8/ringcentral.php
https://plugins.trac.wordpress.org/changeset/3349361/
https://wordpress.org/plugins/rccp-free/#developers
https://www.wordfence.com/threat-intel/vulnerabilities/id/0386ed09-296d-4f33-9fe0-964c0c0a9652?source=cve

Check your stack JSON