Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-104803— WPCOM Member <= 1.7.27 - Unauthenticated Authentication Bypass via 'uuid' and 'code' Parameters on Social-Login Callback

Quick assessment

Affected
whyun WPCOM Member
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 的 WPCOM Member 插件在 1.7.27 及更早版本中存在身份验证绕过漏洞。该漏洞位于通过 钩子注册的社交登录回调处理程序中，可通过 和 参数触发。 漏洞成因在于， 函数中的社交登录流程未进行任何 nonce（一次性令牌）验证、未验证 OAuth 状态（state），且在会话存储中未实现基于访客的命名空间隔离。这使得未认证的攻击者可以构造并发送一个恶意的 GET 请求，将带有攻击者指定名称和值的条目写入全局会话命名空间（通过在键名前添加下划线前缀，绕过默认的每访客前缀机制）。随后，攻击

CVSS 9.8 · Critical EPSS 0.45% · P37

Affected Version Matrix 1

VendorProduct Version RangeStatus
whyun WPCOM Member ≤ 1.7.27 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-104803

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
WPCOM Member <= 1.7.27 - Unauthenticated Authentication Bypass via 'uuid' and 'code' Parameters on Social-Login Callback
Source: CVE Program / CVE List V5
Vulnerability Description
The WPCOM Member plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.7.27 via the `uuid` and `code` parameters of the social-login callback handler registered on the `init` hook. The vulnerability exists because the `login` function's social-login flow performs no nonce validation, no OAuth state verification, and no per-visitor namespace isolation in the session store, allowing an unauthenticated attacker to issue a crafted GET request that writes an attacker-named, attacker-valued entry into the global session namespace (bypassing the per-visitor prefix by prepending an underscore), then issue a second GET request triggering `weapp_new_user()` to read that forged entry and resolve the attacker-supplied `openid` value to a bound WordPress account before `wp_set_auth_cookie()` establishes a fully authenticated session. This makes it possible for unauthenticated attackers to log in as any WordPress user — including administrators — whose bound social provider identifier (openid/unionid) is known or discoverable. Successful exploitation requires that the target site has at least one social provider configured (which activates the vulnerable handler) and that the attacker knows or can enumerate the victim account's bound openid or unionid.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
whyun WPCOM Member 0 ~ 1.7.27 -

II. Public POCs for CVE-2026-104803

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-104803

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-104803 (1)

Vendor Advisories for CVE-2026-104803 (1)

IV. Related Vulnerabilities

Same product: WPCOM Member
Same vendor: whyun
Same weakness: CWE-287

V. Comments for CVE-2026-104803

No comments yet

Leave a comment