Hivepress Authentication
Monthly
Authentication bypass in HivePress Authentication plugin for WordPress (≤1.1.4) allows an unauthenticated network attacker to log in as any WordPress user - including administrators - whose account email is linked to a Facebook account. The plugin's Facebook OAuth handler forwards the caller-supplied access_token directly to the Facebook Graph API and blindly trusts the returned email and user ID, performing no /debug_token audience validation and no comparison of the token's app_id against the configured hp_facebook_app_id. Exploitation requires the attacker to first acquire a valid Facebook access token associated with the victim's account, which is the primary complexity barrier - but once obtained, the attack yields full account takeover with no WordPress credentials required. No public exploit or CISA KEV listing has been identified at the time of analysis.
Authentication bypass in HivePress Authentication plugin for WordPress (≤1.1.4) allows an unauthenticated network attacker to log in as any WordPress user - including administrators - whose account email is linked to a Facebook account. The plugin's Facebook OAuth handler forwards the caller-supplied access_token directly to the Facebook Graph API and blindly trusts the returned email and user ID, performing no /debug_token audience validation and no comparison of the token's app_id against the configured hp_facebook_app_id. Exploitation requires the attacker to first acquire a valid Facebook access token associated with the victim's account, which is the primary complexity barrier - but once obtained, the attack yields full account takeover with no WordPress credentials required. No public exploit or CISA KEV listing has been identified at the time of analysis.