Qode Membership
Monthly
Authentication bypass in the Qode Membership plugin for WordPress, in all versions up to and including 2.0.6.2, lets unauthenticated attackers log in as any existing account, including Administrator accounts, by posting a known or enumerated WordPress login username to the qode_membership_check_facebook_user AJAX action. A typographic error in the Facebook OAuth guard (testing $check_social_useqoder instead of $check_social_user) makes empty() always evaluate true, so the Graph API token-verification branch is dead code and wp_set_auth_cookie() is reached with no credential or token validation. Exploitation requires a valid qode_validate_facebook_login nonce, which is rendered on any public front-end page containing the [qode_user_login] or [qode_user_register] shortcode and is therefore obtainable without authentication; no public exploit code was identified at time of analysis, EPSS is 0.37% (30th percentile), yet the vuln.today decision label is act_now given automatable exploitation and total technical impact.
Authentication bypass in the Qode Membership plugin for WordPress, in all versions up to and including 2.0.6.2, lets unauthenticated attackers log in as any existing account, including Administrator accounts, by posting a known or enumerated WordPress login username to the qode_membership_check_facebook_user AJAX action. A typographic error in the Facebook OAuth guard (testing $check_social_useqoder instead of $check_social_user) makes empty() always evaluate true, so the Graph API token-verification branch is dead code and wp_set_auth_cookie() is reached with no credential or token validation. Exploitation requires a valid qode_validate_facebook_login nonce, which is rendered on any public front-end page containing the [qode_user_login] or [qode_user_register] shortcode and is therefore obtainable without authentication; no public exploit code was identified at time of analysis, EPSS is 0.37% (30th percentile), yet the vuln.today decision label is act_now given automatable exploitation and total technical impact.