{"schema":"threatline.record/2","record":{"id":"CVE-2026-92885","aliases":[],"summary":"Qode Membership <= 2.0.6.2 - Authentication Bypass via Social Login","details":"The Qode Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 2.0.6.2 via the qode_membership_check_facebook_user AJAX action. This is due to a typographic error in the Facebook OAuth token verification guard within the qode_membership_login_user_from_social_network function — the guard condition tests an undefined variable ($check_social_useqoder instead of $check_social_user), causing empty() to always return true and rendering the Graph API token verification branch dead code, leaving wp_set_auth_cookie() reachable with no credential or token validation whatsoever. This makes it possible for unauthenticated attackers to log in as any existing WordPress account — including Administrator-level accounts — by supplying a known or enumerated administrator login name (rather than an email address) in the response[email] parameter, which the fallback path in get_user_by('login', $email) resolves to the matching account. Exploitation does require harvesting a valid qode_validate_facebook_login nonce, but this nonce is rendered on any public front-end page containing the [qode_user_login] or [qode_user_register] shortcode and is therefore obtainable without any prior authentication.","categories":["Unclassified"],"product":"Qode Membership","vendor":"Qode Themes","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-92885","source_modified_at":"2026-10-27T08:28:43.933Z","fetched_at":"2026-10-27T10:24:27.527526Z","product":"Qode Membership","vendor":"Qode Themes","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2.0.6.2","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":9.8,"severity":"Critical","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-27T08:28:43.933Z","modified_at":"2026-10-27T08:28:43.933Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-92885","fetched_at":"2026-10-27T10:24:27.527526Z","source_modified_at":"2026-10-27T08:28:43.933Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26bca6c2-0999-4cf6-9c4e-ddaf528ef808?source=cve"},{"source":"CVE List","url":"https://themeforest.net/item/bridge-creative-multipurpose-wordpress-theme/7315054"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-27T08:28:43.933Z","content_hash":"f5e281b5fb5f4bad74116f2bd449d6634c3c3efba543f80ffba4274c8f2b8ef3"}}