Qode Membership: Authentication bypass in social login allows account takeover
Summary
The Qode Membership plugin for WordPress, which ships with the Bridge theme, contains an authentication bypass in its Facebook social login function. A typo in a token verification condition causes the token check to be skipped, so the plugin logs in the user matching a supplied login name, including administrator accounts. An unauthenticated attacker can take over any WordPress account and therefore the whole site, provided they obtain a nonce that is rendered on public login or registration pages.
Affected
- Qode Membership 2.0.6.2 and all earlier versions
Fixed in
- Vendor-confirmed fixed version: Unknown.
- VulDB states version 2.0.6.3 or later; this is not confirmed by the vendor or Wordfence.
Workaround
- Unknown. No vendor workaround is documented.
- Deactivate the plugin if login and registration via it are not needed.
Exploitation
- Not known to be exploited in the wild; not listed in CISA KEV.
- No public exploit or proof of concept found.
- CISA SSVC: automatable yes, technical impact total.
Our recommendation
- Check whether Qode Membership is installed, including as part of the Bridge theme.
- Update to a confirmed fixed version once the vendor publishes it; deactivate the plugin until then if it is not needed.
- Review administrator accounts for unexpected logins or changes and enforce two-factor authentication.
- Monitor logs for unusual login activity.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Wordfence threat intelligence advisory www.wordfence.com
- VulDB CVE-2026-92885 vuldb.com
- VulDB entry 427067 vuldb.com
- WPScan vulnerability entry wpscan.com
- CVE record mirror (threatint) cve.threatint.com
- Qode Bridge changelog bridge.qodeinteractive.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:31.
Original description (NVD)
The Qode Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 2.0.6.2 via the qode_membership_check_facebook_user AJAX action. This is due to a typographic error in the Facebook OAuth token verification guard within the qode_membership_login_user_from_social_network function — the guard condition tests an undefined variable ($check_social_useqoder instead of $check_social_user), causing empty() to always return true and rendering the Graph API token verification branch dead code, leaving wp_set_auth_cookie() reachable with no credential or token validation whatsoever. This makes it possible for unauthenticated attackers to log in as any existing WordPress account — including Administrator-level accounts — by supplying a known or enumerated administrator login name (rather than an email address) in the response[email] parameter, which the fallback path in get_user_by('login', $email) resolves to the matching account. Exploitation does require harvesting a valid qode_validate_facebook_login nonce, but this nonce is rendered on any public front-end page containing the [qode_user_login] or [qode_user_register] shortcode and is therefore obtainable without any prior authentication.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.