CVE-2025-11920 is a Local File Inclusion vulnerability in the WPCOM Member WordPress plugin (versions up to 1.7.14). It arises from improper control of the filename used in an include/require statement triggered by the action parameter in a shortcode. Authenticated attackers with Contributor or higher privileges can exploit this to include arbitrary PHP files, enabling remote code execution and potential data exposure. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high severity. No patch or official fix has been documented yet, and the plugin is not a cloud-hosted service.

Successful exploitation allows authenticated users with Contributor-level access or higher to execute arbitrary PHP code on the server by including malicious PHP files. This can lead to bypassing access controls, unauthorized data access, and full code execution on the affected server. The high CVSS score reflects the critical nature of these impacts. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level user privileges where possible and monitor for suspicious activity related to shortcode usage. Avoid uploading or allowing PHP files that could be included via the vulnerable parameter. Follow vendor channels for updates on patches or official mitigations.