CVE-2026-92885

The Qode Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 2.0.6.2 via the qode membership check facebook user AJAX action. This is due to a typographic error in the Facebook OAuth token verification guard within the qode membership login user from social network function — the guard condition tests an undefined variable ($check social useqoder instead of $check social user), causing empty() to always return true and rendering the Graph API token verification branch dead code, leaving wp set auth cookie() reachable with no credential or token validation whatsoever. This makes it possible for unauthenticated attackers to log in as any existing WordPress account — including Administrator-level accounts — by supplying a known or enumerated administrator login name (rather than an email address) in the response[email] parameter, which the fallback path in get user by('login', $email) resolves to the matching account. Exploitation does require harvesting a valid qode validate facebook login nonce, but this nonce is rendered on any public front-end page containing the [qode user login] or [qode user register] shortcode and is therefore obtainable without any prior authentication.