CVE-2026-92885 in Qode Membership Plugin
Summary
by MITRE • 10/27/2026
The Qode Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 2.0.6.2 via the qode_membership_check_facebook_user AJAX action. This is due to a typographic error in the Facebook OAuth token verification guard within the qode_membership_login_user_from_social_network function — the guard condition tests an undefined variable ($check_social_useqoder instead of $check_social_user), causing empty() to always return true and rendering the Graph API token verification branch dead code, leaving wp_set_auth_cookie() reachable with no credential or token validation whatsoever. This makes it possible for unauthenticated attackers to log in as any existing WordPress account — including Administrator-level accounts — by supplying a known or enumerated administrator login name (rather than an email address) in the response[email] parameter, which the fallback path in get_user_by('login', $email) resolves to the matching account. Exploitation does require harvesting a valid qode_validate_facebook_login nonce, but this nonce is rendered on any public front-end page containing the [qode_user_login] or [qode_user_register] shortcode and is therefore obtainable without any prior authentication.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/27/2026
The Qode Membership plugin for WordPress contains a critical authentication bypass vulnerability affecting all versions up to 2.0.6.2, which allows unauthenticated attackers to achieve full account takeover of existing user accounts, including those with Administrator privileges. This flaw is rooted in the qode_membership_check_facebook_user AJAX action handler, where a typographic error fundamentally undermines the security controls designed to validate social network logins. Specifically, within the qode_membership_login_user_from_social_network function, the code attempts to verify Facebook OAuth tokens using a guard condition that references an undefined variable named $check_social_useqoder instead of the intended $check_social_user. Because this variable is never defined in the scope, PHP treats it as null or empty, causing the empty() function check to always evaluate to true. This logical error effectively renders the subsequent Graph API token verification branch dead code, meaning that no actual validation of the Facebook access token ever occurs during the authentication process.
The operational impact of this vulnerability is severe, as it allows an attacker to bypass all credential-based security measures and log in as any existing WordPress user simply by providing a known or enumerated login name. The exploitation path relies on the response[email] parameter within the AJAX request. Due to a secondary logic flaw in the fallback mechanism using get_user_by('login', $email), supplying a username rather than an email address allows the system to resolve and authenticate against that specific account regardless of whether it is associated with Facebook or any other social network provider. This means that attackers do not need valid credentials, nor do they need to possess a legitimate Facebook OAuth token. They only require knowledge of a target user's login name, which can often be enumerated through standard WordPress profile URLs or author archives, and the ability to send an AJAX request to the vulnerable endpoint.
While exploitation does technically require obtaining a valid qode_validate_facebook_login nonce, this requirement is trivially bypassed in most real-world scenarios because these nonces are rendered on any public-facing page that contains either the [qode_user_login] or [qode_user_register] shortcode. Since many WordPress sites expose login and registration forms to unauthenticated visitors for user engagement purposes, attackers can easily harvest a valid nonce by simply loading one of these pages in their browser or via automated scraping tools. This eliminates the need for any prior authentication session or complex interaction with the target site before launching the account takeover attack. The combination of an invalid security guard and publicly accessible nonces creates a straightforward path to privilege escalation, potentially granting attackers full control over the WordPress installation if they target administrator accounts.
From a classification perspective, this vulnerability aligns with CWE-287 Improper Authentication, as the system fails to correctly verify credentials or tokens before establishing a session. It also maps closely to CWE-613 Insufficient Session Expiration, given that the nonce mechanism is intended to prevent replay attacks but is rendered ineffective by the underlying authentication bypass. In terms of MITRE ATT&CK tactics, this represents an Initial Access technique where attackers exploit software vulnerabilities to gain entry into a network or system environment without valid credentials. The specific method involves exploiting client-side configuration errors and logic flaws in server-side validation routines rather than traditional injection attacks.
Mitigation strategies must focus on immediate remediation of the source code defect. Site administrators should update the Qode Membership plugin to version 2.0.6.3 or later, where this typographic error has been corrected by properly referencing $check_social_user and ensuring that Graph API token validation is executed as intended. For sites unable to patch immediately due to compatibility concerns with other plugins, a temporary workaround involves removing or disabling the [qode_user_login] and [qode_user_register] shortcodes from public-facing pages if social login functionality is not actively required by unauthenticated users. Additionally, implementing strict rate limiting on AJAX endpoints can help mitigate brute-force enumeration attempts against user accounts while patches are being deployed. Security monitoring should also be enhanced to detect unusual patterns of successful logins originating from the qode_membership_check_facebook_user endpoint without corresponding valid OAuth token exchanges in server logs.