CVE-2026-92885: Qode Membership WordPress Plugin Authentication Bypass

Executive Summary

CVE-2026-92885 is a critical authentication bypass (CVSS 9.8) in the Qode Membership plugin for WordPress, leading to account takeover. It is not known to be exploited and is not listed in CISA KEV.

Vulnerability Overview

Root Cause

The qode_membership_check_facebook_user AJAX action guards its Facebook Graph API token verification with a condition that checks an undefined variable ($check_social_useqoder instead of $check_social_user). Because of this typographic error, the verification never runs.

Attack Vector

1. The attacker loads any public page containing the [qode_user_login] or [qode_user_register] shortcode and obtains a valid qode_validate_facebook_login nonce.
2. The attacker submits the AJAX request with a known or guessed username or email in the response[email] parameter.
3. The plugin skips token verification and logs the attacker in as that user, including administrators.

Timeline

• 2026-09-17: Vendor notified
• 2026-10-26: Disclosed
• 2026-10-27: CVE published (assigned via Wordfence)

Remediation

1. Check for a Qode Membership update and apply it as soon as one ships.
2. Until patched, deactivate the plugin or remove the login and register shortcodes, and block the qode_membership_check_facebook_user AJAX action at the WAF.
3. Audit administrator accounts and recent logins:

wp user list --role=administrator --fields=ID,user_login,user_registered

4. Rotate WordPress salts and force password resets for privileged users if suspicious logins are found.

References

• VulDB: CVE-2026-92885
• OffSeq Threat Radar
• NIST NVD