CVE-2026-18056
Received Received - Intake

Authentication Bypass in HivePress WordPress Plugin

Publication date: 2026-09-06

Last updated on: 2026-09-06

Assigner: Wordfence

Description
The HivePress Authentication plugin for WordPress is vulnerable to Authentication Bypass via the access_token parameter in all versions up to, and including, 1.1.4. This is due to the authenticate_user function's Facebook authenticator resolving third-party identity by forwarding the attacker-supplied access_token to the Facebook Graph API and trusting the returned email and ID verbatim, without performing any application ID or audience validation — specifically, no /debug_token verification and no comparison of the token's app_id against the configured hp_facebook_app_id. This makes it possible for unauthenticated attackers to authenticate as any existing WordPress user, including administrators, whose email address is associated with a Facebook account for which the attacker can obtain any valid access token. Important Note: To exploit the vulnerability, the attacker must obtain the victim's access token.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-06
Last Modified
2026-09-06
Generated
2026-09-06
AI Q&A
2026-09-06
EPSS Evaluated
N/A
NVD
CVE-2026-18056
EUVD
EUVD-2026-72043

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
hivepress hivepress_authentication to 1.1.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The HivePress Authentication plugin for WordPress has an authentication bypass vulnerability in versions up to 1.1.4. Attackers can exploit the access_token parameter to authenticate as any WordPress user, including administrators, by forwarding a stolen Facebook access token to the plugin's authentication function without proper validation.

Detection Guidance

To detect this vulnerability, check if the HivePress Authentication plugin version is up to 1.1.4 or earlier. Inspect WordPress logs for unusual authentication attempts via the access_token parameter. Monitor network traffic for requests to Facebook Graph API without proper token validation.

Impact Analysis

Unauthenticated attackers could gain administrative access to your WordPress site if they obtain a valid Facebook access token for a user account linked to your site. This could lead to full site compromise, data theft, or malicious modifications.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive user data, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations may face compliance violations, fines, or legal consequences if exploited.

Mitigation Strategies

Update the HivePress Authentication plugin to the latest version where the vulnerability is fixed. Ensure the Facebook App Secret is configured in the plugin settings. Monitor for unauthorized access attempts or unusual authentication logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18056. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart