Qode Membership CVE-2026-92885

Two concrete prerequisites, both obtainable without authentication: (1) a public front-end page must render the [qode_user_login] or [qode_user_register] shortcode, from which the attacker scrapes a valid qode_validate_facebook_login nonce; and (2) the attacker must know or enumerate a target account's WordPress login username (not email), which is supplied in the response[email] parameter and resolved by get_user_by('login', ...). No credentials, OAuth token, or user interaction are required, and all versions through 2.0.6.2 are affected. Limiting factors that temper real-world risk: the vulnerable login/register shortcode must actually be present on a publicly reachable page, and the attacker must supply a valid login name (administrator usernames are often enumerable but are not guaranteed to be known).

Signals mostly align toward high priority with one tension to flag. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) describes a remote, unauthenticated flaw with full confidentiality, integrity and availability impact, and the mechanism - a dead OAuth token-verification branch that leaves wp_set_auth_cookie() reachable with no credential check - makes administrator account takeover trivial. SSVC reinforces this: Automatable=yes and Technical Impact=total, which is why the vuln.today Decision label is act_now. The counter-signal is EPSS at 0.37% (30th percentile), which is low; this is consistent with SSVC Exploitation=none, the absence of CISA KEV listing, and no public exploit reference in the input, so the low EPSS most plausibly reflects a recently disclosed issue with no observed exploitation yet rather than a hard-to-exploit one. Conclusion: this is a genuine priority - the bug is trivially and automatably exploitable for full site compromise - and the low EPSS should not downgrade it; treat act_now as driven by ease and impact, not by evidence of active exploitation, which is currently absent.

An unauthenticated attacker visits any public page rendering the [qode_user_login] or [qode_user_register] shortcode to scrape a valid qode_validate_facebook_login nonce, then submits a crafted qode_membership_check_facebook_user AJAX request supplying a known or enumerated administrator login name in response[email]. Because the token-verification guard tests an undefined variable and is dead code, the request sets an authenticated session cookie for that administrator with no credential or OAuth validation. No public exploit code is identified in the provided sources, but the technique is fully described by the reporting vendor.