---
id: "CVE-2026-92885"
kind: "vulnerability"
aliases: ["CVE-2026-92885"]
title: "WordPress Qode Membership plugin: unauthenticated login as any user, including admins"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wp-plugins"]
not_affected_if: ["no-public-login-shortcode", "plugin-not-installed", "plugin-updated"]
published_at: "2026-10-27T09:16:34+00:00"
first_seen_at: "2026-10-27T09:30:50+00:00"
updated_at: "2026-10-27T09:32:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92885", "first_seen_at": "2026-10-27T09:30:50+00:00"}]
---

# WordPress Qode Membership plugin: unauthenticated login as any user, including admins

The Qode Membership WordPress plugin up to and including 2.0.6.2 has a typo in its Facebook login guard that disables token checks, so anyone can log in by sending an existing account's login name. An unauthenticated attacker who can fetch the public login nonce can take over any account, including administrators.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin Plugins screen or `wp plugin get qode-membership --field=version` (path and slug unknown from sources; the plugin name is Qode Membership)
- Look for the AJAX action `qode_membership_check_facebook_user` in the plugin's source

## Fix

- Update the Qode Membership plugin to a version later than `2.0.6.2` (fixed version unknown from sources)
- If no fixed version is available, deactivate the plugin or remove the `[qode_user_login]` and `[qode_user_register]` shortcodes
- Review administrator accounts for unexpected logins and rotate their passwords

## Timeline

- 2026-10-27T09:30:50+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-92885

## From the sources

The Qode Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 2.0.6.2 via the qode_membership_check_facebook_user AJAX action. This is due to a typographic error in the Facebook OAuth token verification guard within the qode_membership_login_user_from_social_network function — the guard condition tests an undefined variable ($check_social_useqoder instead of $check_social_user), causing empty() to always return true and rendering the Graph API token verification branch dead code, leaving wp_set_auth_cookie() reachable with no credential or token validation whatsoever. This makes it possible for unauthenticated attackers to log in as any existing WordPress account — including Administrator-level accounts — by supplying a known or enumerated administrator login name (rather than an email address) in the response[email] parameter, which the fallback path in get_user_by('login', $email) resolves to the matching account. Exploitation does require harvesting a valid qode_validate_facebook_login nonce, but this nonce is rendered on any public front-end page containing the [qode_user_login] or [qode_user_register] shortcode and is therefore obtainable without any prior authentication.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_