Is CVE-2026-92885 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-92885 being exploited in the wild.

How severe is CVE-2026-92885?

Critical severity, with a CVSS score of 9.8, published 27 October 2026.

Which products and versions are affected?

Qode Membership up to and including 2.0.6.2.

Is there a fix for CVE-2026-92885?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-92885 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-92885?

Check whether you run Qode Membership at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-92885: Qode Membership plugin authentication bypass in Facebook OAuth

CVE-2026-92885 · Severity: critical · CVSS 9.8 · Published 2026-10-27

The Qode Membership plugin for WordPress contains a critical flaw in its Facebook login feature that allows attackers to take over any user account, including administrator accounts, without knowing the password. An attacker only needs to obtain a publicly available security token (nonce) from any page with a login form and supply a target account username to gain full access. This could lead to complete compromise of WordPress sites using this plugin.

Vendors: Qode.

Quick answers

Is CVE-2026-92885 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-92885 being exploited in the wild.
How severe is CVE-2026-92885?: Critical severity, with a CVSS score of 9.8, published 27 October 2026.
Which products and versions are affected?: Qode Membership up to and including 2.0.6.2.
Is there a fix for CVE-2026-92885?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-92885 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-92885?: Check whether you run Qode Membership at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability stems from a typo in the Facebook OAuth token verification logic within the qode_membership_login_user_from_social_network function—a variable name is misspelled ($check_social_useqoder instead of $check_social_user), causing the token validation guard to always fail and skip token verification. An unauthenticated attacker can invoke the qode_membership_check_facebook_user AJAX action with a valid nonce (publicly exposed on login/register pages) and supply any known or enumerated WordPress username in the response[email] parameter, which the fallback code path then resolves to a matching account and sets authentication cookies without credential validation.

Affected products

Qode Membership up to and including 2.0.6.2

Timeline

2026-10-27: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.