CVE-2026-18056: HivePress Authentication <= 1.1.4 - Unauthenticated Authentication Bypass via 'access_token' Parameter to Facebook Authenticator
The HivePress Authentication plugin for WordPress is vulnerable to Authentication Bypass via the accesstoken parameter in all versions up to, and including, 1.1.4. This is due to the authenticateuser function's Facebook authenticator resolving third-party identity by forwarding the attacker-supplied accesstoken to the Facebook Graph API and trusting the returned email and ID verbatim, without performing any application ID or audience validation — specifically, no /debugtoken verification and no comparison of the token's appid against the configured hpfacebookappid. This makes it possible for unauthenticated attackers to authenticate as any existing WordPress user, including administrators, whose email address is associated with a Facebook account for which the attacker can obtain any valid access token. Important Note: To exploit the vulnerability, the attacker must obtain the victim's access token.
Affected Software
Event History
Frequently Asked Questions
What must an attacker obtain to exploit this issue?
The attacker must obtain a valid Facebook access token for the victim's Facebook account. Exploitation also depends on the victim being an existing WordPress user whose email address is associated with that Facebook account.
Which accounts could be compromised?
Any existing WordPress account matching the email returned for the Facebook token may be targeted, including administrator accounts. The attacker does not need prior WordPress authentication.
What configuration weakness enables the bypass?
The Facebook authenticator accepts an attacker-supplied access_token and trusts the Facebook Graph API response without validating the token's audience or confirming that its app_id matches the configured hp_facebook_app_id. The provided data does not state whether Facebook authentication is enabled by default.
How can administrators determine whether their site is in scope?
Sites using HivePress Authentication version 1.1.4 or earlier are affected according to the provided information. Review whether the site uses the plugin's Facebook authentication flow and whether WordPress users have email addresses associated with Facebook accounts.