CVE-2025-7955
Critical
Description
The RingCentral Communications plugin for WordPress is vulnerable to Authentication Bypass due to improper validation within the ringcentral_admin_login_2fa_verify() function in versions 1.5 to 1.6.8. This makes it possible for unauthenticated attackers to log in as any user simply by supplying identical bogus codes.
SeverityCritical
CVSS9.8
Exploit probability—
ProductRingCentral Communications Plugin – FREE
PublishedAug 28, 2025
First seenAug 28, 2025
Weakness typeCWE-287Improper authentication
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pbmacintyre RingCentral Communications Plugin – FREE | 1.5 ≤ v ≤ 1.6.8 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.