{"id":"CVE-2026-92885","published":"2026-10-27T09:16:34.630","lastModified":"2026-10-27T14:52:13.410","description":"The Qode Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 2.0.6.2 via the qode_membership_check_facebook_user AJAX action. This is due to a typographic error in the Facebook OAuth token verification guard within the qode_membership_login_user_from_social_network function — the guard condition tests an undefined variable ($check_social_useqoder instead of $check_social_user), causing empty() to always return true and rendering the Graph API token verification branch dead code, leaving wp_set_auth_cookie() reachable with no credential or token validation whatsoever. This makes it possible for unauthenticated attackers to log in as any existing WordPress account — including Administrator-level accounts — by supplying a known or enumerated administrator login name (rather than an email address) in the response[email] parameter, which the fallback path in get_user_by('login', $email) resolves to the matching account. Exploitation does require harvesting a valid qode_validate_facebook_login nonce, but this nonce is rendered on any public front-end page containing the [qode_user_login] or [qode_user_register] shortcode and is therefore obtainable without any prior authentication.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-287"],"vendors":[],"products":[],"references":[{"url":"https://themeforest.net/item/bridge-creative-multipurpose-wordpress-theme/7315054","tags":[]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26bca6c2-0999-4cf6-9c4e-ddaf528ef808?source=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Qode Membership WordPress plugin (≤2.0.6.2) contains a typo in Facebook OAuth verification that renders authentication checks ineffective: an undefined variable ($check_social_useqoder) causes empty() to always return true, bypassing Graph API token validation and allowing unauthenticated attackers to log in as any user—including administrators—by supplying a known login name via the qode_membership_check_facebook_user AJAX endpoint.","exploitability":"Exploitation requires harvesting a valid qode_validate_facebook_login nonce from any page containing [qode_user_login] or [qode_user_register], but otherwise needs no authentication, privileges, or user interaction.","blast_radius":"Successful exploitation grants full account takeover of any WordPress account—including administrative accounts—enabling complete site compromise, data exfiltration, and persistence.","remediation":"Upgrade to Qode Membership version 2.0.6.3 or later, which corrects the typo by replacing $check_social_useqoder with $check_social_user in the verification guard.","detection":"Look for POST requests to /wp-admin/admin-ajax.php?action=qode_membership_check_facebook_user containing a valid qode_validate_facebook_login nonce and a response[email] parameter matching an existing WordPress login name (not email); such requests are abnormal because legitimate Facebook logins would not use this endpoint with a login name.","tags":["auth-bypass","account-takeover","wordpress","plugin","oauth"],"model":"garnet-coder","analyzedAt":"2026-10-28T09:58:54.371Z"}}