Authentication Bypass in Qode Membership Plugin for WordPress

CVE-2026-92885

What is CVE-2026-92885?

The Qode Membership plugin for WordPress has a vulnerability that allows unauthenticated attackers to bypass authentication and gain access to user accounts. This issue arises from a typo in the Facebook OAuth token verification process that leads to an ineffective guard, allowing potential exploitation through known administrator names. Attackers can manipulate the related nonce, easily accessible on public pages, to execute unauthorized logins, which could include high-level administrative access.

References