CVE-2026-18056

Name of the Vulnerable Software and Affected Versions HivePress Authentication versions prior to 1.1.5

Description An authentication bypass exists due to the way the authenticate user() function handles Facebook authentication. The system resolves third-party identity by forwarding the access token parameter to the Facebook Graph API and trusting the returned email and ID without performing application ID or audience validation. Specifically, the process lacks /debug token verification and fails to compare the token's app id against the configured hp facebook app id. This allows unauthenticated attackers to impersonate any WordPress user, including administrators, provided the attacker possesses a valid access token for a Facebook account associated with the victim's email address.

Recommendations Update HivePress Authentication to version 1.1.5 or later. As a temporary mitigation, restrict the use of the access token parameter in the Facebook authentication process until the update is applied.