Qode Membership (<= 2.0.6.2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/qode-membership--2.0.6.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 27 Oct 2026 10:55:16 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgQode Membership: Authentication Bypass and Account Takeover (CVE-2026-92885)https://feed.craftedsignal.io/briefs/2026-10-qode-membership-auth-bypass/Tue, 27 Oct 2026 10:55:16 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-qode-membership-auth-bypass/The Qode Membership WordPress plugin is vulnerable to authentication bypass via a typographic error in the Facebook OAuth token verification guard, allowing unauthenticated account takeover.The Qode Membership plugin for WordPress (all versions up to and including 2.0.6.2) contains a vulnerability in the qode_membership_check_facebook_user AJAX action. A typo in the qode_membership_login_user_from_social_network function (testing an undefined variable instead of the OAuth token) renders the verification logic ineffective. This allows unauthenticated attackers to bypass credential validation and log in as any WordPress user, including administrators, by providing a username in the response[email] parameter. Exploitation requires a qode_validate_facebook_login nonce, which is obtainable from public front-end pages containing the [qode_user_login] or [qode_user_register] shortcodes.

]]>criticaladvisory