# CVE-2026-18056: HivePress Authentication Facebook token bypass in user login

Source: https://junglewise.ai/threats/cve-2026-18056-hivepress-authentication-facebook-token-bypass-in-user-login  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-06. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-18056 · Severity: high · CVSS 7.5 · Published 2026-09-06

The HivePress Authentication plugin for WordPress allows attackers to bypass login security by submitting a Facebook access token without proper validation. If an attacker obtains a user's valid Facebook token, they can authenticate as that user on any WordPress site using this plugin, including administrator accounts. This provides a path to account takeover and full site compromise.

## Quick answers

**Is CVE-2026-18056 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-18056 being exploited in the wild.

**How severe is CVE-2026-18056?** High severity, with a CVSS score of 7.5, published 6 September 2026.

**Which products and versions are affected?** HivePress Authentication up to and including 1.1.4.

**Is there a fix for CVE-2026-18056?** A patch was published on 2026-09-06: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-18056 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-18056?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the authenticate_user function's Facebook authenticator, which forwards an attacker-supplied access_token to the Facebook Graph API and trusts the returned email and ID without validation. The plugin fails to perform /debug_token verification and does not compare the token's app_id against the configured hp_facebook_app_id. This allows unauthenticated attackers to forge authentication for any WordPress user whose email is associated with a Facebook account, provided the attacker possesses or can obtain a valid access token for that Facebook account. The vulnerability affects all versions up to and including 1.1.4, and a fix has been committed to the project repository.

## Affected products

- HivePress Authentication up to and including 1.1.4

## Timeline

- 2026-09-06: disclosed
- 2026-09-06: patched: Fix committed to repository

## References

- [https://developers.facebook.com/docs/facebook-login/guides/advanced/manual-flow/](https://developers.facebook.com/docs/facebook-login/guides/advanced/manual-flow/)
- [https://github.com/hivepress/hivepress-authentication/commit/f97d9109002905cf57597d15c535d1155dc64657](https://github.com/hivepress/hivepress-authentication/commit/f97d9109002905cf57597d15c535d1155dc64657)