HivePress Authentication CVE-2026-18056

Facebook Login must be explicitly enabled in HivePress settings (hp_user_auth_methods must include 'facebook') and hp_facebook_app_id must be configured - these are non-default settings requiring deliberate administrator action, so the vulnerability is not present in default HivePress installations. The target WordPress user's account email must be associated with a Facebook account. Most critically, the attacker must possess any valid Facebook access token for the victim's Facebook identity - not limited to tokens from the site's own app, which means tokens from any Facebook application the victim has authorized qualify. Sites that have not enabled Facebook Login, users whose WordPress email is not linked to Facebook, or scenarios where the attacker cannot obtain a valid victim Facebook token are not exploitable.

The CVSS 3.1 score of 7.5 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a genuine tension between catastrophic post-exploitation impact and a non-trivial pre-exploitation barrier. The attacker must obtain a valid Facebook access token linked to the victim's Facebook account - critically, a token issued by any Facebook application will suffice because the plugin does not validate token audience against the site's own app ID, meaning tokens from rogue third-party apps, phishing flows, or compromised services all qualify. Once a usable token is in hand, the attack is fully network-accessible, requires no WordPress credentials, and produces immediate full account takeover including administrator-level access. The feature gate (hp_user_auth_methods must include 'facebook' and hp_facebook_app_id must be configured) limits the exposed population to sites that have deliberately enabled Facebook Login, which reduces the attack surface relative to a default-on vulnerability. No EPSS score was provided and the vulnerability is absent from the CISA KEV catalog, so empirical exploitation frequency is unknown. Given that successful exploitation yields administrator-level WordPress access, sites with Facebook Login enabled should treat this as high priority despite the elevated attack complexity.

An attacker identifies a WordPress site running HivePress with Facebook Login enabled and enumerates the administrator's email address via public WordPress user enumeration or profile pages. The attacker creates or abuses a third-party Facebook app to obtain a valid access token for the victim's Facebook account - exploiting the fact that any app-issued token suffices, not only tokens issued by the site's own registered app. The attacker then sends a crafted POST request to the HivePress authentication endpoint with the victim's access_token parameter, bypassing WordPress password and any MFA checks, and receives an authenticated session cookie as the administrator.