CVE-2026-92885: Qode Membership <= 2.0.6.2 - Authentication Bypass via Social Login
The Qode Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 2.0.6.2 via the qodemembershipcheckfacebookuser AJAX action. This is due to a typographic error in the Facebook OAuth token verification guard within the qodemembershiploginuserfromsocialnetwork function — the guard condition tests an undefined variable ($checksocialuseqoder instead of $checksocialuser), causing empty() to always return true and rendering the Graph API token verification branch dead code, leaving wpsetauthcookie() reachable with no credential or token validation whatsoever. This makes it possible for unauthenticated attackers to log in as any existing WordPress account — including Administrator-level accounts — by supplying a known or enumerated administrator login name (rather than an email address) in the response[email] parameter, which the fallback path in getuserby('login', $email) resolves to the matching account. Exploitation does require harvesting a valid qodevalidatefacebooklogin nonce, but this nonce is rendered on any public front-end page containing the [qodeuserlogin] or [qodeuserregister] shortcode and is therefore obtainable without any prior authentication.
Affected Software
Event History
Frequently Asked Questions
Which sites are practically exposed to exploitation?
Sites using an affected version are exposed when a public front-end page renders the [qode_user_login] shortcode or the relevant login form, because that page provides a valid qode_validate_facebook_login nonce required for the AJAX request.
What does an attacker need to successfully take over an account?
The attacker needs a valid qode_validate_facebook_login nonce and the login name of an existing WordPress account. No Facebook OAuth token, password, or other credential validation is required by the vulnerable path.
How severe can a successful compromise be?
An unauthenticated attacker can authenticate as any existing WordPress account whose login name is known or enumerated. This includes Administrator-level accounts, allowing full site takeover.