RingCentral Communications 1.5 - 1.6.8 - Missing Server‑Side Verification to Authentication Bypass via ringcentral_admin_login_2fa_verify Function
critical
The RingCentral Communications plugin for WordPress is vulnerable to Authentication Bypass due to improper validation within the ringcentral_admin_login_2fa_verify() function in versions 1.5 to 1.6.8. This makes it possible for unauthenticated attackers to log in as any user simply by supplying identical bogus codes.
- CVSS:
- 9.8
- Affected:
- 1.5 – 1.6.8
- Fixed in:
- 1.7.0
- Disclosed:
- Aug 27, 2025
CVE-2025-7955 on NVD →
RingCentral Communications Plugin – FREE [rccp-free] <= 1.6.8 (unfixed + closed)
unknown
[en] Cross-Site Request Forgery (CSRF) vulnerability in Peter MacIntyre RingCentral Communications allows Stored XSS.This issue affects RingCentral Communications: from n/a through 1.6.1.
- Affected:
- up to 1.6.8
- Fix:
- No patched version reported
- Disclosed:
- Dec 2, 2024
CVE-2024-53770 on NVD →
RingCentral Communications <= 1.6.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
medium
The RingCentral Communications Plugin – FREE plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.1. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web...
- CVSS:
- 5.4
- Affected:
- up to 1.6.1
- Fix:
- No patched version reported
- Disclosed:
- Nov 28, 2024
CVE-2024-53770 on NVD →
RingCentral Communications Plugin – FREE [rccp-free] < 1.7.0
unknown
- Affected:
- up to 1.7.0
- Fixed in:
- 1.7.0
CVE-2025-7955 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database