CVE-2026-92885
Received Received - Intake

Authentication Bypass in Qode Membership Plugin

Publication date: 2026-10-27

Last updated on: 2026-10-27

Assigner: Wordfence

Description
The Qode Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 2.0.6.2 via the qode_membership_check_facebook_user AJAX action. This is due to a typographic error in the Facebook OAuth token verification guard within the qode_membership_login_user_from_social_network function — the guard condition tests an undefined variable ($check_social_useqoder instead of $check_social_user), causing empty() to always return true and rendering the Graph API token verification branch dead code, leaving wp_set_auth_cookie() reachable with no credential or token validation whatsoever. This makes it possible for unauthenticated attackers to log in as any existing WordPress account — including Administrator-level accounts — by supplying a known or enumerated administrator login name (rather than an email address) in the response[email] parameter, which the fallback path in get_user_by('login', $email) resolves to the matching account. Exploitation does require harvesting a valid qode_validate_facebook_login nonce, but this nonce is rendered on any public front-end page containing the [qode_user_login] or [qode_user_register] shortcode and is therefore obtainable without any prior authentication.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-27
Last Modified
2026-10-27
Generated
2026-10-27
AI Q&A
2026-10-27
EPSS Evaluated
N/A
NVD
CVE-2026-92885
EUVD
EUVD-2026-110640

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Qode Themes Qode Membership 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Qode Membership plugin for WordPress has an authentication bypass vulnerability due to a typo in the Facebook OAuth token verification. The condition checks an undefined variable ($check_social_useqoder) instead of the correct one ($check_social_user), causing the verification to always pass. This allows unauthenticated attackers to log in as any WordPress account, including administrators, by providing a known username.

Detection Guidance

Check for the Qode Membership plugin version 2.0.6.2 or lower. Look for unauthorized login attempts or unusual admin account activities. Inspect network traffic for requests to the qode_membership_check_facebook_user AJAX endpoint.

Impact Analysis

This vulnerability allows attackers to take over any WordPress account, including admin accounts, without needing valid credentials. Attackers can gain full control of the website, steal data, install malware, or deface the site. The only requirement is a valid nonce, which is exposed on public pages with login or registration shortcodes.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive user data, violating GDPR and HIPAA requirements for data protection and access control. Organizations using this plugin may face compliance violations, legal penalties, and reputational damage due to potential data breaches.

Mitigation Strategies

Update the Qode Membership plugin to the latest version. Disable the plugin if an update is not available. Monitor for suspicious login attempts and revoke any unauthorized sessions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-92885. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart