{"id":"CVE-2026-92885","kind":"vulnerability","aliases":["CVE-2026-92885"],"related":[],"title":"WordPress Qode Membership plugin: unauthenticated login as any user, including admins","description":"The Qode Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 2.0.6.2 via the qode_membership_check_facebook_user AJAX action. This is due to a typographic error in the Facebook OAuth token verification guard within the qode_membership_login_user_from_social_network function — the guard condition tests an undefined variable ($check_social_useqoder instead of $check_social_user), causing empty() to always return true and rendering the Graph API token verification branch dead code, leaving wp_set_auth_cookie() reachable with no credential or token validation whatsoever. This makes it possible for unauthenticated attackers to log in as any existing WordPress account — including Administrator-level accounts — by supplying a known or enumerated administrator login name (rather than an email address) in the response[email] parameter, which the fallback path in get_user_by('login', $email) resolves to the matching account. Exploitation does require harvesting a valid qode_validate_facebook_login nonce, but this nonce is rendered on any public front-end page containing the [qode_user_login] or [qode_user_register] shortcode and is therefore obtainable without any prior authentication.","summary":"The Qode Membership WordPress plugin up to and including 2.0.6.2 has a typo in its Facebook login guard that disables token checks, so anyone can log in by sending an existing account's login name. An unauthenticated attacker who can fetch the public login nonce can take over any account, including administrators.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wp-plugins"],"not_affected_if":["no-public-login-shortcode","plugin-not-installed","plugin-updated"],"how_to_check":"- Check the installed plugin version in the WordPress admin Plugins screen or `wp plugin get qode-membership --field=version` (path and slug unknown from sources; the plugin name is Qode Membership)\n- Look for the AJAX action `qode_membership_check_facebook_user` in the plugin's source","fix":"- Update the Qode Membership plugin to a version later than `2.0.6.2` (fixed version unknown from sources)\n- If no fixed version is available, deactivate the plugin or remove the `[qode_user_login]` and `[qode_user_register]` shortcodes\n- Review administrator accounts for unexpected logins and rotate their passwords","status":"open","published_at":"2026-10-27T09:16:34+00:00","first_seen_at":"2026-10-27T09:30:50+00:00","triaged_at":"2026-10-27T09:32:51+00:00","updated_at":"2026-10-27T09:32:51+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-27T09:32:51Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Qode Membership plugin to a version later than `2.0.6.2` (fixed version unknown from sources)\n- If no fixed version is available, deactivate the plugin or remove the `[qode_user_login]` and `[qode_user_register]` shortcodes\n- Review administrator accounts for unexpected logins and rotate their passwords","reach":"internet","title":"WordPress Qode Membership plugin: unauthenticated login as any user, including admins","impact":"high","summary":"The Qode Membership WordPress plugin up to and including 2.0.6.2 has a typo in its Facebook login guard that disables token checks, so anyone can log in by sending an existing account's login name. An unauthenticated attacker who can fetch the public login nonce can take over any account, including administrators.","category":"package","nicknames":[],"who_cares":["wordpress","wp-plugins","self-hosted"],"confidence":0.85,"needs_auth":"no","worst_case":"Attacker logs in as any WordPress administrator without a password","analyst_note":"Confirm the first fixed version of Qode Membership after 2.0.6.2 from the plugin changelog or the NVD/Wordfence entry.","how_to_check":"- Check the installed plugin version in the WordPress admin Plugins screen or `wp plugin get qode-membership --field=version` (path and slug unknown from sources; the plugin name is Qode Membership)\n- Look for the AJAX action `qode_membership_check_facebook_user` in the plugin's source","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-updated","no-public-login-shortcode"],"who_is_affected":"Sites running the Qode Membership plugin version 2.0.6.2 or earlier that expose the [qode_user_login] or [qode_user_register] shortcode on a public page. Sites without this plugin, or without those shortcodes on public pages, are not exposed through this path.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000712,"input_tokens":3623,"output_tokens":699,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-92885':14A,17A '2.0.6.2':35B,100C 'account':57B,75B,91C,192C,197C,231C 'action':109C 'address':211C 'admin':11A 'administr':77B,195C,204C 'administrator-level':194C 'ajax':108C 'alway':152C 'anyon':49B 'api':159C 'attack':63B,184C 'auth':168C 'authent':87C,272C 'branch':162C 'bypass':88C 'caus':149C 'check':47B,105C,141C,146C 'code':164C 'condit':136C 'contain':255C 'cooki':169C 'credenti':173C 'cve':12A,15A 'dead':163C 'disabl':45B 'due':112C 'email':210C,215C,226C 'empti':150C 'end':253C 'enumer':203C 'error':116C 'exist':56B,190C 'exploit':232C 'facebook':41B,106C,119C,240C 'fallback':219C 'fetch':66B 'front':252C 'front-end':251C 'function':133C 'get':222C 'graph':158C 'guard':43B,123C,135C 'harvest':235C 'host':21B 'includ':10A,34B,76B,99C,193C 'instead':144C 'known':201C 'lead':89C 'leav':165C 'level':196C 'log':51B,186C 'login':6A,42B,59B,69B,128C,205C,225C,241C,259C 'make':179C 'match':230C 'membership':3A,28B,80C,104C,127C 'name':60B,206C 'network':132C 'nonc':70B,242C,245C 'oauth':120C 'obtain':268C 'packag':18B 'page':254C 'paramet':216C 'path':220C 'plugin':4A,25B,30B,81C 'possibl':181C 'prior':271C 'public':68B,250C 'qode':2A,27B,79C,103C,126C,238C,257C,261C 'rather':207C 'reachabl':170C 'regist':263C 'render':156C,247C 'requir':234C 'resolv':227C 'respons':214C 'return':153C 'self':20B 'self-host':19B 'send':54B 'set':167C 'shortcod':264C 'social':131C,142C,147C 'suppli':199C 'take':72B 'takeov':92C 'test':137C 'therefor':267C 'token':46B,121C,160C,175C 'true':154C 'typo':38B 'typograph':115C 'unauthent':5A,62B,183C 'undefin':139C 'useqod':143C 'user':9A,107C,129C,148C,223C,258C,262C 'valid':176C,237C,239C 'variabl':140C 'verif':122C,161C 'version':95C 'via':101C 'vulner':85C 'whatsoev':177C 'within':124C 'without':269C 'wordpress':1A,22B,29B,83C,191C 'wp':24B,166C 'wp-plugin':23B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Qode Membership plugin version 2.0.6.2 or earlier that expose the [qode_user_login] or [qode_user_register] shortcode on a public page. Sites without this plugin, or without those shortcodes on public pages, are not exposed through this path.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T09:16:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92885","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92885","severity":null,"published_at":"2026-10-27T09:16:34+00:00","modified_at":"2026-10-27T09:16:34+00:00","first_seen_at":"2026-10-27T09:30:50+00:00","fetched_at":"2026-10-27T09:30:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}