Skip to content
Threat Feed
Subscribe

Product

WPCOM Member (<= 1.7.27)

1 brief RSS
critical advisory

Authentication Bypass Vulnerability in WPCOM Member Plugin

An authentication bypass vulnerability (CVE-2026-104803) in the WPCOM Member WordPress plugin allows unauthenticated attackers to hijack user sessions, including administrative accounts, by exploiting insufficient nonce and session validation in the social-login callback handler.

WPCOM Member wordpress authentication-bypass web-vulnerability
1r 1t 1c