Executive brief
The HivePress Authentication plugin for WordPress allows attackers to bypass login security by submitting a Facebook access token without proper validation. If an attacker obtains a user's valid Facebook token, they can authenticate as that user on any WordPress site using this plugin, including administrator accounts. This provides a path to account takeover and full site compromise.
Technical details
The vulnerability exists in the authenticate_user function's Facebook authenticator, which forwards an attacker-supplied access_token to the Facebook Graph API and trusts the returned email and ID without validation. The plugin fails to perform /debug_token verification and does not compare the token's app_id against the configured hp_facebook_app_id. This allows unauthenticated attackers to forge authentication for any WordPress user whose email is associated with a Facebook account, provided the attacker possesses or can obtain a valid access token for that Facebook account. The vulnerability affects all versions up to and including 1.1.4, and a fix has been committed to the project repository.
Affected products
- HivePress Authentication up to and including 1.1.4
Timeline
- 2026-09-06: disclosed
- 2026-09-06: patched: Fix committed to repository