WordPress Qode Membership Facebook OAuth Authentication Bypass

The Qode Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 2.0.6.2 via the qode_membership_check_facebook_user AJAX action. This is due to a typographic error in the Facebook OAuth token verification guard within the qode_membership_login_user_from_social_network function — the guard condition tests an undefined variable ($check_social_useqoder instead of $check_social_user), causing empty() to always return true and rendering the Graph API token verification branch dead code, leaving wp_set_auth_cookie() reachable with no credential or token validation whatsoever. This makes it possible for unauthenticated attackers to log in as any existing WordPress account — including Administrator-level accounts — by supplying a known or enumerated administrator login name (rather than an email address) in the response[email] parameter, which the fallback path in get_user_by('login', $email) resolves to the matc

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Qode Membership plugin for WordPress contains a critical authentication bypass vulnerability (CVSS 9.8) affecting all versions through 2.0.6.2. A typographic error in the Facebook OAuth token verification logic—where a misspelled variable name ($check_social_useqoder instead of $check_social_user) causes the security guard to fail silently—allows unauthenticated attackers to bypass login controls via the qode_membership_check_facebook_user AJAX action. This directly enables account takeover attacks against any WordPress site using this plugin, putting user data, site integrity, and administrative access at immediate risk. The vulnerability is particularly dangerous because it requires minimal effort to exploit and affects the foundational authentication mechanism.

Casky's 283 mapped skills would detect this attack pattern across MITRE techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access) by identifying suspicious AJAX requests to qode_membership_check_facebook_user without proper token validation, anomalous social authentication logins bypassing standard OAuth verification flows, and unauthorized account access patterns from unauthenticated sources. Practitioners using Casky would see findings highlighting failed or missing variable references in authentication guards, AJAX endpoints accepting requests with empty or malformed OAuth tokens, and authentication events that bypass expected cryptographic verification steps—allowing them to detect exploitation attempts in real-time before accounts are compromised.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-92885.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-92885

Casky has 283 skills that investigate the attack patterns behind CVE-2026-92885. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn