Qode Membership: Authentication Bypass and Account Takeover (CVE-2026-92885)
The Qode Membership WordPress plugin is vulnerable to authentication bypass via a typographic error in the Facebook OAuth token verification guard, allowing unauthenticated account takeover.
CVE search metadata
CVE search record: CVE-2026-92885. Severity: critical. CVSS: 9.8. KEV: no. Product: Qode Membership (<= 2.0.6.2). Brief: Qode Membership: Authentication Bypass and Account Takeover (CVE-2026-92885). Brief link: https://feed.craftedsignal.io/briefs/2026-10-qode-membership-auth-bypass/
Triage facts
Revision 1- Applicability
- Qode Membership (<= 2.0.6.2)
- Evidence
- Unknown
- Severity
- Critical
- Sources
- 1 public source
- Freshness
- Revision 1Oct 27, 10:55 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
The Qode Membership plugin for WordPress (all versions up to and including 2.0.6.2) contains a vulnerability in the qode_membership_check_facebook_user AJAX action. A typo in the qode_membership_login_user_from_social_network function (testing an undefined variable instead of the OAuth token) renders the verification logic ineffective. This allows unauthenticated attackers to bypass credential validation and log in as any WordPress user, including administrators, by providing a username in the response[email] parameter. Exploitation requires a qode_validate_facebook_login nonce, which is obtainable from public front-end pages containing the [qode_user_login] or [qode_user_register] shortcodes.