Zero Radar
← feed
CriticalVulnerabilityCVE-2026-92885updated 27 Oct 2026, 09:32 UTC

Qode Membership WordPress plugin lets anyone log in as admin

Attackers without any password can log into your WordPress site as an administrator, if they know or can guess an admin username. From there they can take over the whole site.

Official, 2 sources
SeverityCriticalCVSS 9.8 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker visits siteOpens a public page with the login shortcode
  2. 2Harvests nonceNonce is shown on any public page
  3. 3Sends forged login requestUses an admin login name, no password
  4. 4Plugin skips token checkTypo makes the Facebook check dead code
  5. 5Admin session issuedWordPress sets an auth cookie
  6. ResultAttacker controls the admin account

What happened

The Qode Membership plugin's Facebook social login function has a typo in a verification check, so the token check is skipped and wp_set_auth_cookie() runs with no credential validation. Unauthenticated users can pass an admin login name to log in as that account.

Why it is dangerous: Anyone on the internet can take over any WordPress account, including administrators, enabling full site compromise, data theft, and malware injection. Sites with public login or registration pages using the plugin are most exposed.

Are you affected?

You are affected if you run the Qode Membership WordPress plugin version 2.0.6.2 or earlier.

Qode Membership plugin for WordPress, all versions up to and including 2.0.6.2

What to do

  1. Check your installed Qode Membership plugin version and confirm whether it is 2.0.6.2 or earlier
  2. Deactivate the Qode Membership plugin until a fixed version is installed, if one is not yet available
  3. Review administrator accounts and recent logins for unexpected activity
  4. Change administrator passwords and check the official plugin source for a patched release

Timeline

  1. 27 Oct 2026, 09:16 UTC
    Publicly disclosed
  2. 27 Oct 2026, 09:16 UTC
    Reported by NVD · NVD
  3. 27 Oct 2026, 09:17 UTC
    Picked up by Zero Radar
  4. 27 Oct 2026, 09:32 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-92885 · GHSA-hj69-4738-f2v2
CVSS
9.8 / 10
EPSS
0.4% chance of exploitation within 30 days
Disclosed
27 Oct 2026, 09:16 UTC
On Zero Radar
27 Oct 2026, 09:17 UTC (1 min after disclosure)
Last change
27 Oct 2026, 09:32 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Qode Membership WordPress plugin lets anyone log in as admin · Zero Radar