CVE-2026-92885

Name of the Vulnerable Software and Affected Versions Qode Membership versions prior to 2.0.6.3

Description An authentication bypass exists that allows for account takeover via the qode membership check facebook user AJAX action. The issue stems from a typographic error in the qode membership login user from social network() function, where the guard condition checks an undefined variable $check social useqoder instead of $check social user. This causes the empty() check to always return true, bypassing the Graph API token verification and allowing wp set auth cookie() to be executed without credential validation. Unauthenticated attackers can log in as any user, including administrators, by providing a known login name in the response[email] parameter. This process requires a qode validate facebook login nonce, which is publicly available on pages using the [qode user login] or [qode user register] shortcodes.

Recommendations Update Qode Membership to a version newer than 2.0.6.2. As a temporary mitigation, restrict access to the qode membership check facebook user AJAX action or remove the [qode user login] and [qode user register] shortcodes from public pages to prevent nonce harvesting.