CVE-2025-11920 | WPCOM Member Plugin up to 1.7.14 on WordPress Shortcode action file inclusion

A vulnerability identified as critical has been detected in WPCOM Member Plugin up to 1.7.14 on WordPress. Affected by this issue is some unknown functionality of the component Shortcode Handler. The manipulation of the argument action leads to file inclusion.

This vulnerability is referenced as CVE-2025-11920. Remote exploitation of the attack is possible. No exploit is available.