# CVE-2026-92885: Qode Membership plugin authentication bypass in Facebook OAuth

Source: https://junglewise.ai/threats/cve-2026-92885-the-qode-membership-plugin-for-wordpress-is-vulnerable-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-92885 · Severity: critical · CVSS 9.8 · Published 2026-10-27

The Qode Membership plugin for WordPress contains a critical flaw in its Facebook login feature that allows attackers to take over any user account, including administrator accounts, without knowing the password. An attacker only needs to obtain a publicly available security token (nonce) from any page with a login form and supply a target account username to gain full access. This could lead to complete compromise of WordPress sites using this plugin.

Vendors: [Qode](https://junglewise.ai/threats/vendors/qode).

## Quick answers

**Is CVE-2026-92885 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92885 being exploited in the wild.

**How severe is CVE-2026-92885?** Critical severity, with a CVSS score of 9.8, published 27 October 2026.

**Which products and versions are affected?** Qode Membership up to and including 2.0.6.2.

**Is there a fix for CVE-2026-92885?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-92885 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-92885?** Check whether you run Qode Membership at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability stems from a typo in the Facebook OAuth token verification logic within the qode_membership_login_user_from_social_network function—a variable name is misspelled ($check_social_useqoder instead of $check_social_user), causing the token validation guard to always fail and skip token verification. An unauthenticated attacker can invoke the qode_membership_check_facebook_user AJAX action with a valid nonce (publicly exposed on login/register pages) and supply any known or enumerated WordPress username in the response[email] parameter, which the fallback code path then resolves to a matching account and sets authentication cookies without credential validation.

## Affected products

- Qode Membership up to and including 2.0.6.2

## Timeline

- 2026-10-27: disclosed

## References

- [https://themeforest.net/item/bridge-creative-multipurpose-wordpress-theme/7315054](https://themeforest.net/item/bridge-creative-multipurpose-wordpress-theme/7315054)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/26bca6c2-0999-4cf6-9c4e-ddaf528ef808?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/26bca6c2-0999-4cf6-9c4e-ddaf528ef808?source=cve)