Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-92885— Qode Membership <= 2.0.6.2 - Authentication Bypass via Social Login

Quick assessment

Affected
Qode Themes Qode Membership
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 的 Qode Membership 插件在所有 2.0.6.2 及更早版本中，存在通过 AJAX 操作触发的身份验证绕过漏洞，可能导致账户被接管。该漏洞源于 函数中 Facebook OAuth 令牌验证守卫存在拼写错误：守卫条件检查了一个未定义的变量 （而非正确的 ），导致 函数始终返回 true，从而使 Graph API 令牌验证分支成为死代码。结果， 可在未进行任何凭据或令牌验证的情况下被调用。 这使得未认证的攻击者能够通过提交已知或枚举出的管理员登录名（而非电子邮件地址）到响应参数 中

CVSS 9.8 · Critical
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-92885

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Qode Membership <= 2.0.6.2 - Authentication Bypass via Social Login
Source: CVE Program / CVE List V5
Vulnerability Description
The Qode Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 2.0.6.2 via the qode_membership_check_facebook_user AJAX action. This is due to a typographic error in the Facebook OAuth token verification guard within the qode_membership_login_user_from_social_network function — the guard condition tests an undefined variable ($check_social_useqoder instead of $check_social_user), causing empty() to always return true and rendering the Graph API token verification branch dead code, leaving wp_set_auth_cookie() reachable with no credential or token validation whatsoever. This makes it possible for unauthenticated attackers to log in as any existing WordPress account — including Administrator-level accounts — by supplying a known or enumerated administrator login name (rather than an email address) in the response[email] parameter, which the fallback path in get_user_by('login', $email) resolves to the matching account. Exploitation does require harvesting a valid qode_validate_facebook_login nonce, but this nonce is rendered on any public front-end page containing the [qode_user_login] or [qode_user_register] shortcode and is therefore obtainable without any prior authentication.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Qode Themes Qode Membership 0 ~ 2.0.6.2 -

II. Public POCs for CVE-2026-92885

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-92885

请登录查看更多情报信息。

Vendor Pages for CVE-2026-92885 (1)

Other References for CVE-2026-92885 (1)

IV. Related Vulnerabilities

Same weakness: CWE-287