lee1981 (@lee1981b) on X

What it is

CVE-2026-92885 is an authentication bypass (CWE-287, CVSS 3.1 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in the Facebook social login of Qode Membership, up to and including 2.0.6.2. The finder is 0xwackydawg, per Wordfence and the CNA. The post is a CyberForge "CVE of the Day" write-up. It adds the exact AJAX action, the exploitation signals and an investigation order.

How it works

Wordfence attributes the flaw to a misspelled variable in the guard around Facebook Graph API token verification, so the verification branch never runs. The local-account lookup and cookie creation stay reachable. The affected AJAX action is qode_membership_check_facebook_user. Per the CNA, the lookup falls back to login name even though the input field is labelled email, so any account identifier may work, not just emails. The required nonce can be taken from public pages that carry the login or register shortcodes.

Preconditions / Affected

• Qode Membership 2.0.6.2 or earlier, active and with a reachable social-login handler.
• A public login or registration shortcode page, which is the nonce source.
• An existing account to select, including an administrator. The bypass does not create users.

What to do

• Deploy Qode Membership 2.0.6.3 or later through the vendor's supported process. The Bridge 30.9 changelog (9 October 2026) lists this plugin version and a Facebook token-verification fix.
• Record the theme version and the active plugin version separately. A new Bridge download does not prove the companion plugin was replaced.
• Until patched, restrict the vulnerable flow with supported controls and check that they work. Hiding the login button is not shown to disable the server-side handler.
• Preserve request, session and audit records before or alongside the fix.
• Investigate in this order: public form, social-login request, session or cookie evidence, selected user, later action. Escalate on an unexplained privileged session or an owner-denied change tied to that flow.
• After patching, test in a nonproduction fixture that valid logins work and invalid identity evidence is rejected, including the login-name lookup path.
• Invalidate sessions and review accounts only where findings justify it. The update does not end earlier sessions.

Caveats

• KEV: no match in the 27 October 2026 catalogue (1,760 entries). EPSS is 0.368% (percentile 30.461%). CISA SSVC lists Exploitation none, Automatable yes, Technical Impact total.
• No verified public PoC or active campaign was found, and no IOCs were published. The page says these signals do not clear a site.
• The page did not review a Qode source diff, so the fix is confirmed only by Wordfence and the changelog.
• NVD is deferred. No CVSS v4.0 score exists, and the GitHub 0.0 value means unavailable, not zero.
• Takeover gives the selected account's existing authority. The record does not establish OS root, malware or data theft.
• An HTTP 200, a nonce or a generic AJAX hit alone does not show takeover.