CVE-2026-18056

🚨 CVE-2026-18056 The HivePress Authentication plugin for WordPress is vulnerable to Authentication Bypass via the access token parameter in all versions up to, and including, 1.1.4. This is due to the authenticate user function's Facebook authenticator resolving third-party identity by forwarding the attacker-supplied access token to the Facebook Graph API and trusting the returned email and ID verbatim, without performing any application ID or audience validation — specifically, no /debug token verification and no comparison of the token's app id against the configured hp facebook app id. This makes it possible for unauthenticated attackers to authenticate as any existing WordPress user, including administrators, whose email address is associated with a Facebook account for which the attacker can obtain any valid access token. Important Note: To exploit the vulnerability, the attacker must obtain the victim's access token.

🎖@cveNotify