A critical authentication bypass in the Qode Membership plugin for WordPress, versions up to and including 2.0.6.2, can let an unauthenticated attacker take over an existing account, including an Administrator account. The attacker needs two things: the target account's login name, and a valid nonce from a public page that uses the plugin's login or registration shortcode.
What Is It
CVE-2026-92885 is an authentication bypass (CWE-287) that leads to account takeover. It is reachable through the plugin's qode_membership_check_facebook_user AJAX action. The root cause is a typo in the Facebook OAuth token verification guard inside the qode_membership_login_user_from_social_network function. The guard checks an undefined variable ($check_social_useqoder instead of $check_social_user), so empty() always returns true. As a result, the Graph API token verification branch never runs, and wp_set_auth_cookie() can be reached with no credential or token validation at all.
To exploit it, an attacker supplies a known or enumerated login name, such as an administrator's username, in the response[email] parameter. A fallback call to get_user_by('login', $email) then resolves that name to the matching account. The attack needs a valid qode_validate_facebook_login nonce. That nonce appears on any public front-end page that contains the [qode_user_login] or [qode_user_register] shortcode, so on sites with such a page, an attacker can get it without logging in.
Why It Matters
Wordfence scores this CVSS 3.1 9.8 (CRITICAL) with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. It can be exploited over the network with low complexity, and it needs no privileges and no user interaction. An attacker who logs in as an Administrator fully controls the WordPress site, which means a high impact on confidentiality, integrity and availability.
As of this writing, CVE-2026-92885 has no CISA KEV entry, so the supplied sources do not confirm active exploitation. NVD lists the record's status as "Received" (published 2026-10-27), so NVD has not yet completed its analysis.
What's Vulnerable
- Vendor: Qode Interactive
- Product: Qode Membership plugin for WordPress
- Affected versions: All versions up to and including 2.0.6.2
The risk is highest on sites that show the [qode_user_login] or [qode_user_register] shortcode on a public page, because those pages expose the nonce the attack needs. NVD's references also include the ThemeForest listing for the Bridge WordPress theme, which is also published by Qode Interactive.
Patch Status
The supplied NVD record does not name a fixed version, and since there is no KEV entry, there is no CISA-mandated required action or due date. Administrators should check the Wordfence advisory and the vendor for an update that goes beyond 2.0.6.2. Until a confirmed fix is applied, consider disabling the plugin or removing the login and registration shortcodes from public pages. Also check for unexpected Administrator logins.