CVE-2025-7955

Published
View on NVD ↗
CVSS v3
9.8
CRITICAL
CVSS v2
N/A
Affected
1
PROJECT

Description

The RingCentral Communications plugin for WordPress is vulnerable to Authentication Bypass due to improper validation within the ringcentral_admin_login_2fa_verify() function in versions 1.5 to 1.6.8. This makes it possible for unauthenticated attackers to log in as any user simply by supplying identical bogus codes.

<p>This plugin allows for the use of the RingCentral communication tools platform based on the RingCentral PHP API.</p> <p>This plugin makes calls to: https://ringcentral.github.io/ringcentral-embeddable-voice/adapter.js</p> <p>The embeddable code base is here: https://github.com/ringcentral/ringcentral-embeddable</p> <p>The license is here: https://github.com/ringcentral/ringcentral-js-widgets/blob/master/LICENSE</p> <p>This is an out-of-the-box embeddable web phone app that helps developers to integrate RingCentral services<br /> into their own WordPress installations. This is controllable in the settings page with a checkbox to turn it on or off.</p> <h4>Features</h4> <ul> <li>RingCentral Embedded Phone app &#8211;<br /> RingCentral&#8217;s embedded phone app can be turned on or off and calls can be made from within the WordPress Admin area. Sub-features<br /> can now be toggled on/off as desired. </li> <li>Call Me Request widget &#8211;<br /> Feature for adding a Call Me request Widget to the sidebar on the public side of your WordPress installation. This allows Website<br /> visitors to call you (using the RingCentral RingOut feature) and if no one is on-line to answer the request will be stored on the admin side. </li> <li>Newsletter Sign Up widget &#8211;<br /> Feature for adding a Newsletter (New Post) signup Widget to the sidebar on the public side of your WordPress installation.<br /> Asking for both or one of email address and mobile number as communication points (double opt-in). </li> <li>New Newsletter (Post) announcements &#8211;<br /> Based on configuration settings, you can send out automatic announcements to your collected newsletter list based on their<br /> provided (double opt-in) contact information: email and / or mobile. </li> <li>Manually add subscribers &#8211;<br /> Feature to manually add to your list of Newsletter announcement subscribers with name email and mobile number. The new subscriber<br /> will still have to opt-in to the list. </li> <li>List / Manage subscribers &#8211;<br /> Feature to display your existing list of Newsletter announcement subscribers. You can delete individually or collectively.<br /> There is no edit feature as changes will need to be initiated by the subscriber and re-validated via the opt-in process. </li> <li>List / Manage Call Me Requests &#8211;<br /> Feature to display your existing list of Call Me requests. You can delete individually or collectively. List shows caller<br /> name, phone number to call back, and reason for the call. </li> <li>Default pages are created for you to customize &#8211;<br /> Default WordPress pages are created upon activation of the plugin. A very basic confirmation email page is provided.<br /> A basic page for confirming opt-out requests is also provided. Page names are: &#8216;eMail Confirmation&#8217; &amp; &#8216;eMail Unsubscribe&#8217;.<br /> NOTE: permainks must be set to &#8220;Post name&#8221; </li> <li>New Database tables are created &#8211;<br /> New tables are created in the database and seeded with basic starting data in order for the plugin to operate correctly.<br /> All table names are prefixed by &#8216;ringcentral_&#8217;. The plugin drops these tables if the plugin is ever deleted, so be sure<br /> to save any data if you ever plan on deleting the plugin. </li> </ul> <h3>Contribute</h3> <p>If you find this useful and if you want to contribute, here are some ways:<br /> 1. You can <a href="https://paladin-bs.com/contact" rel="nofollow ugc">write me</a> and submit your bug reports or improvement suggestions;</p>
WordPress Plugin DirectoryWordPress Plugin Directory
5.4K