CVE-2026-104803

Deferred Deferred - Pending Action

Authentication Bypass in WPCOM Member WordPress Plugin

Publication date: 2026-10-10

Last updated on: 2026-10-11

Assigner: Wordfence

Description

The WPCOM Member plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.7.27 via the `uuid` and `code` parameters of the social-login callback handler registered on the `init` hook. The vulnerability exists because the `login` function's social-login flow performs no nonce validation, no OAuth state verification, and no per-visitor namespace isolation in the session store, allowing an unauthenticated attacker to issue a crafted GET request that writes an attacker-named, attacker-valued entry into the global session namespace (bypassing the per-visitor prefix by prepending an underscore), then issue a second GET request triggering `weapp_new_user()` to read that forged entry and resolve the attacker-supplied `openid` value to a bound WordPress account before `wp_set_auth_cookie()` establishes a fully authenticated session. This makes it possible for unauthenticated attackers to log in as any WordPress user — including administrators — whose bound social provider identifier (openid/unionid) is known or discoverable. Successful exploitation requires that the target site has at least one social provider configured (which activates the vulnerable handler) and that the attacker knows or can enumerate the victim account's bound openid or unionid.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-10

Last Modified

2026-10-11

Generated

2026-10-19

AI Q&A

2026-10-10

EPSS Evaluated

2026-10-18

NVD

CVE-2026-104803

EUVD

EUVD-2026-96279

Affected Vendors & Products

Vendor	Product	Version / Range
whyun	WPCOM	Member 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

The WPCOM Member plugin for WordPress has an authentication bypass flaw in versions up to 1.7.27. An attacker can exploit this by sending crafted requests to the social-login callback handler. The vulnerability allows unauthenticated users to log in as any WordPress user, including administrators, by manipulating session data and bypassing security checks.

Detection Guidance

Check WordPress sites with the WPCOM Member plugin versions up to 1.7.27 for unusual login activity or unauthorized access attempts. Inspect server logs for GET requests to social-login callback handlers with uuid and code parameters. Look for session entries with underscores in the global namespace.

Impact Analysis

This vulnerability allows attackers to gain unauthorized access to WordPress accounts, including admin accounts. If exploited, attackers could take control of the website, steal data, install malware, or deface the site. It requires the site to have a social provider configured and the attacker to know the victim's social identifier.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive user data, violating GDPR and HIPAA compliance. Unauthorized access may result in data breaches, leading to legal penalties, fines, and reputational damage for organizations handling protected health or personal data.

Mitigation Strategies

Update the WPCOM Member plugin to the latest version beyond 1.7.27 if available.
Disable the social-login callback handler if not essential.
Implement nonce validation and OAuth state verification in the login flow.
Ensure session storage uses per-visitor namespace isolation without underscore prefixes.

Hi! I’m here to help you understand CVE-2026-104803. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70