CVE-2026-92885: 
WordPress vulnerability analysis and mitigation

CVE-2026-92885 is an authentication bypass vulnerability in the Qode Membership plugin for WordPress, affecting versions up to and including 2.0.6.2. The flaw resides in the qode_membership_check_facebook_user AJAX action, where a typographic error in the Facebook OAuth token verification guard allows unauthenticated attackers to bypass authentication entirely. An attacker in possession of a valid qode_validate_facebook_login nonce can trigger wp_set_auth_cookie without any actual token validation, logging in as any existing WordPress account — including administrators. The vulnerability is estimated as HIGH severity (Feedly, Radar Offseq).

The root cause is classified as CWE-287 (Improper Authentication), specifically a typographic (typo) error in the conditional guard that is supposed to verify the Facebook OAuth token before setting an authentication cookie. Because the guard fails silently due to the typo, the code path proceeds to call wp_set_auth_cookie unconditionally. The attacker must supply a valid qode_validate_facebook_login nonce (obtainable from the WordPress site's frontend) and a known or enumerated WordPress login name via the response[email] parameter in the AJAX request. No valid Facebook OAuth token is required, making exploitation straightforward for anyone who can enumerate usernames (Feedly, Radar Offseq).

Successful exploitation grants an unauthenticated attacker full authentication as any existing WordPress user, including site administrators. This results in complete compromise of confidentiality, integrity, and availability of the WordPress site — attackers can install malicious plugins, exfiltrate data, deface content, create backdoor accounts, or pivot to the underlying server if further vulnerabilities exist. All sites running Qode Membership ≤ 2.0.6.2 with the Facebook login feature enabled are at risk (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been confirmed as of the time of this report. The vulnerability was inserted into Feedly's threat intelligence database on October 27, 2026, and no CISA KEV catalog entry or EPSS score is currently available. However, the low exploitation complexity — requiring only a valid nonce and a known username — makes this vulnerability highly attractive to opportunistic attackers targeting WordPress sites (Feedly, VulDB).

1. Reconnaissance: Identify WordPress sites using the Qode Membership plugin (version ≤ 2.0.6.2) via passive scanning tools (e.g., WPScan, Shodan) or by checking for the plugin's presence in /wp-content/plugins/qode-membership/.
2. Nonce Acquisition: Load the WordPress site's frontend page that includes the Facebook login button to retrieve the qode_validate_facebook_login nonce embedded in the page's JavaScript or HTML source.
3. Username Enumeration: Enumerate valid WordPress usernames via the WordPress REST API (/wp-json/wp/v2/users), login error messages, or author archive pages to identify administrator accounts.
4. Craft Malicious AJAX Request: Send a POST request to /wp-admin/admin-ajax.php with the following parameters:
   • action=qode_membership_check_facebook_user
   • nonce=<valid_qode_validate_facebook_login_nonce>
   • response[email]=<target_username_or_email>
5. Authentication Cookie Set: Due to the typographic error in the token verification guard, the server calls wp_set_auth_cookie without validating any Facebook OAuth token, returning a valid WordPress session cookie for the target account.
6. Privileged Access: Use the returned session cookie to authenticate to the WordPress admin dashboard (/wp-admin/) as the target user, achieving full site control (Feedly, Radar Offseq).

• Network: Unusual POST requests to /wp-admin/admin-ajax.php with action=qode_membership_check_facebook_user from IPs not associated with Facebook's infrastructure; high-frequency nonce requests to pages containing the Facebook login widget.
• Logs: WordPress access logs showing successful authentication events (wp_set_auth_cookie) for administrator accounts without corresponding Facebook OAuth callback traffic; repeated AJAX requests to admin-ajax.php with the qode_membership_check_facebook_user action from a single IP.
• File System: Newly created or modified plugin files in /wp-content/plugins/; unexpected admin user accounts added to the WordPress database (wp_users table).
• Process/Behavior: New administrator accounts appearing in WordPress user management without corresponding registration emails; unexpected plugin installations or theme modifications shortly after suspicious AJAX activity (Feedly).

Site administrators should immediately update the Qode Membership plugin to a version beyond 2.0.6.2 once a patched release is available from the vendor (Qode Themes). As an interim workaround, disabling the Facebook login feature within the plugin settings will prevent exploitation of this specific AJAX action. Additionally, restricting access to wp-admin/admin-ajax.php for unauthenticated users via a Web Application Firewall (WAF) rule targeting the qode_membership_check_facebook_user action can reduce exposure until a patch is applied (Feedly, Radar Offseq).