CVE-2025-7955
Published
CVSS v3
9.8
CRITICAL
CVSS v2
N/A
Affected
1
PROJECT
Description
The RingCentral Communications plugin for WordPress is vulnerable to Authentication Bypass due to improper validation within the ringcentral_admin_login_2fa_verify() function in versions 1.5 to 1.6.8. This makes it possible for unauthenticated attackers to log in as any user simply by supplying identical bogus codes.
<p>This plugin allows for the use of the RingCentral communication tools platform based on the RingCentral PHP API.</p>
<p>This plugin makes calls to: https://ringcentral.github.io/ringcentral-embeddable-voice/adapter.js</p>
<p>The embeddable code base is here: https://github.com/ringcentral/ringcentral-embeddable</p>
<p>The license is here: https://github.com/ringcentral/ringcentral-js-widgets/blob/master/LICENSE</p>
<p>This is an out-of-the-box embeddable web phone app that helps developers to integrate RingCentral services<br />
into their own WordPress installations. This is controllable in the settings page with a checkbox to turn it on or off.</p>
<h4>Features</h4>
<ul>
<li>RingCentral Embedded Phone app –<br />
RingCentral’s embedded phone app can be turned on or off and calls can be made from within the WordPress Admin area. Sub-features<br />
can now be toggled on/off as desired.
</li>
<li>Call Me Request widget –<br />
Feature for adding a Call Me request Widget to the sidebar on the public side of your WordPress installation. This allows Website<br />
visitors to call you (using the RingCentral RingOut feature) and if no one is on-line to answer the request will be stored on the admin side.
</li>
<li>Newsletter Sign Up widget –<br />
Feature for adding a Newsletter (New Post) signup Widget to the sidebar on the public side of your WordPress installation.<br />
Asking for both or one of email address and mobile number as communication points (double opt-in).
</li>
<li>New Newsletter (Post) announcements –<br />
Based on configuration settings, you can send out automatic announcements to your collected newsletter list based on their<br />
provided (double opt-in) contact information: email and / or mobile.
</li>
<li>Manually add subscribers –<br />
Feature to manually add to your list of Newsletter announcement subscribers with name email and mobile number. The new subscriber<br />
will still have to opt-in to the list.
</li>
<li>List / Manage subscribers –<br />
Feature to display your existing list of Newsletter announcement subscribers. You can delete individually or collectively.<br />
There is no edit feature as changes will need to be initiated by the subscriber and re-validated via the opt-in process.
</li>
<li>List / Manage Call Me Requests –<br />
Feature to display your existing list of Call Me requests. You can delete individually or collectively. List shows caller<br />
name, phone number to call back, and reason for the call.
</li>
<li>Default pages are created for you to customize –<br />
Default WordPress pages are created upon activation of the plugin. A very basic confirmation email page is provided.<br />
A basic page for confirming opt-out requests is also provided. Page names are: ‘eMail Confirmation’ & ‘eMail Unsubscribe’.<br />
NOTE: permainks must be set to “Post name”
</li>
<li>New Database tables are created –<br />
New tables are created in the database and seeded with basic starting data in order for the plugin to operate correctly.<br />
All table names are prefixed by ‘ringcentral_’. The plugin drops these tables if the plugin is ever deleted, so be sure<br />
to save any data if you ever plan on deleting the plugin.
</li>
</ul>
<h3>Contribute</h3>
<p>If you find this useful and if you want to contribute, here are some ways:<br />
1. You can <a href="https://paladin-bs.com/contact" rel="nofollow ugc">write me</a> and submit your bug reports or improvement suggestions;</p>