External risk intelligence

Qode Membership WordPress Plugin Authentication Bypass Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-92885

The vulnerability exists in a WordPress membership plugin that provides public-facing login and registration functionality. Because the affected features are designed to be accessible on public front-end pages to facilitate user account management, the vulnerable endpoint is exposed to the internet by design.

Authentication Bypass

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This security advisory concerns a critical vulnerability in a WordPress membership plugin. The flaw allows unauthenticated attackers to bypass login procedures and potentially take over any user account, including administrator accounts, by exploiting an error in how social network logins are verified. This could grant attackers full control over compromised WordPress sites.

Login bypass allows unauthorized account access.
Affects public-facing user management features.
Confirm relevance and exposure of this plugin.

Attack Path

How an attacker could exploit the issue

An attacker can bypass authentication in the Qode Membership plugin for WordPress by exploiting a typo in the Facebook login process. This allows them to log in as any user, including administrators, by providing a known username and a valid nonce obtained from public pages.

Requires access to a valid nonce.
Triggers via an AJAX action with a malformed token.
Leads to account takeover and unauthorized access.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to bypass authentication and take over any existing WordPress account, including administrator accounts, by exploiting a typographic error in the Facebook OAuth token verification. This is possible because a critical verification step fails to execute, enabling a fallback path that allows login with just a known username. The necessary nonce for exploitation can be obtained from any public page displaying the login or registration shortcodes.

Any WordPress account, including administrators.
Via a known username and obtainable nonce.
Complete account takeover is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Qode Membership plugin's authentication bypass flaw impacts WordPress sites, making account takeover possible. Website owners and platform administrators are likely responsible for managing this plugin. The first step is to identify all WordPress instances using the plugin, confirm if the login/registration shortcodes are exposed publicly, and then assess the risk to determine the remediation priority.

WordPress site owners should own the issue.
Verify public exposure of shortcodes and plugin usage.
Plan remediation based on risk and business impact.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Qode Membership plugin?

Qode Membership is a WordPress plugin often bundled with themes like Bridge. It manages front-end user registration and login features, allowing site visitors to create accounts or sign in via social networks directly from the website interface rather than the standard WordPress dashboard.

How does CVE-2026-92885 allow account takeover?

This vulnerability, classified as Improper Authentication (CWE-287), stems from a coding error in the plugin's Facebook login verification. Because the code fails to validate the OAuth token, the system mistakenly accepts unauthorized login attempts. An attacker can use this to sign in as any site user, including administrators, without a password.

Can this vulnerability be triggered without a valid nonce?

No, exploitation requires a valid security token called a nonce. However, these are not secret; the plugin automatically renders them on any public-facing page that uses the user login or registration shortcodes. This makes the necessary token easily obtainable by anyone visiting the site.

Is my site at risk if I use this plugin?

According to Halo Surface Signal, this vulnerability is very likely to be relevant if your site uses the affected plugin features. Since the plugin is designed to provide public-facing login and registration pages, the vulnerable endpoint is exposed to the internet by default, making it accessible to any remote attacker.

What should I do to secure my WordPress site?

Begin by auditing your environment to confirm if the Qode Membership plugin is active. Check if your site utilizes the [qode_user_login] or [qode_user_register] shortcodes on public pages. If these are in use, prioritize restricting access to these pages or disabling the affected membership features until you can apply the necessary updates.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.