CVE-2026-92885

Summary

The Qode Membership WordPress plugin (≤2.0.6.2) contains a typo in Facebook OAuth verification that renders authentication checks ineffective: an undefined variable ($check_social_useqoder) causes empty() to always return true, bypassing Graph API token validation and allowing unauthenticated attackers to log in as any user—including administrators—by supplying a known login name via the qode_membership_check_facebook_user AJAX endpoint.

Exploitability

Exploitation requires harvesting a valid qode_validate_facebook_login nonce from any page containing [qode_user_login] or [qode_user_register], but otherwise needs no authentication, privileges, or user interaction.

Blast radius

Successful exploitation grants full account takeover of any WordPress account—including administrative accounts—enabling complete site compromise, data exfiltration, and persistence.

Detection

Look for POST requests to /wp-admin/admin-ajax.php?action=qode_membership_check_facebook_user containing a valid qode_validate_facebook_login nonce and a response[email] parameter matching an existing WordPress login name (not email); such requests are abnormal because legitimate Facebook logins would not use this endpoint with a login name.

Prioritized remediation

Upgrade to Qode Membership version 2.0.6.3 or later, which corrects the typo by replacing $check_social_useqoder with $check_social_user in the verification guard.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.