{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/qode-membership--2.0.6.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-92885"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Qode Membership (\u003c= 2.0.6.2)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe Qode Membership plugin for WordPress (all versions up to and including 2.0.6.2) contains a vulnerability in the \u003ccode\u003eqode_membership_check_facebook_user\u003c/code\u003e AJAX action. A typo in the \u003ccode\u003eqode_membership_login_user_from_social_network\u003c/code\u003e function (testing an undefined variable instead of the OAuth token) renders the verification logic ineffective. This allows unauthenticated attackers to bypass credential validation and log in as any WordPress user, including administrators, by providing a username in the \u003ccode\u003eresponse[email]\u003c/code\u003e parameter. Exploitation requires a \u003ccode\u003eqode_validate_facebook_login\u003c/code\u003e nonce, which is obtainable from public front-end pages containing the [qode_user_login] or [qode_user_register] shortcodes.\u003c/p\u003e\n","date_modified":"2026-10-27T10:55:16Z","date_published":"2026-10-27T10:55:16Z","id":"https://feed.craftedsignal.io/briefs/2026-10-qode-membership-auth-bypass/","summary":"The Qode Membership WordPress plugin is vulnerable to authentication bypass via a typographic error in the Facebook OAuth token verification guard, allowing unauthenticated account takeover.","title":"Qode Membership: Authentication Bypass and Account Takeover (CVE-2026-92885)","url":"https://feed.craftedsignal.io/briefs/2026-10-qode-membership-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Qode Membership (\u003c= 2.0.6.2)","version":"https://jsonfeed.org/version/1.1"}