CVE-2026-92885: Qode Membership WordPress Plugin Auth Bypass (CVSS 9.8) — Detection and Remediation Guide

NVD has published CVE-2026-92885, a CVSS 9.8 (Critical), network-exploitable vulnerability in the Qode Membership plugin for WordPress — all versions up to and including 2.0.6.2. The flaw allows unauthenticated attackers to bypass authentication entirely and take over arbitrary user accounts, including administrator accounts, via the plugin's Facebook social-login AJAX handler.

What makes this bug remarkable — and instructive — is its root cause: a typographic error in a variable name. The token-verification guard inside qode_membership_login_user_from_social_network() tests $check_social_useqoder instead of $check_social_user. Because that misspelled variable is never defined, PHP's empty() check always evaluates to true, and the entire Facebook Graph API token-verification branch becomes dead code. The function proceeds directly to wp_set_auth_cookie(), minting a valid WordPress session for whatever user account the attacker specifies — no valid Facebook token required.

This is a pre-authentication, remotely exploitable account takeover on one of the most widely deployed CMS platforms on the planet. If your organization — or your customers — run WordPress sites with Qode Membership installed, treat this as an emergency patch event.

Technical Analysis

Affected Products

How the Vulnerability Works (Defender's View)

WordPress plugins expose AJAX endpoints through admin-ajax.php, which is reachable without authentication via the wp_ajax_nopriv_{action} hook. Qode Membership registers the qode_membership_check_facebook_user action to handle Facebook OAuth logins.

The intended flow:

1. Client submits a Facebook user ID and OAuth access token to admin-ajax.php?action=qode_membership_check_facebook_user.
2. The plugin calls the Facebook Graph API to verify the token is valid and belongs to the claimed user.
3. Only if verification succeeds does the plugin map the Facebook ID to a WordPress account and call wp_set_auth_cookie().

The broken flow in ≤ 2.0.6.2:

1. The guard condition that decides whether token verification is needed checks empty($check_social_useqoder) — a variable that does not exist.
2. An undefined variable passed to empty() always returns true in PHP.
3. The Graph API verification branch is therefore never executed — dead code.
4. Execution falls through to wp_set_auth_cookie() for the attacker-supplied user identity.

Exploitation requirements: network access to the WordPress site, the plugin active, and knowledge of (or the ability to enumerate) a target user. No credentials, no valid Facebook account, no user interaction. The attacker receives a fully valid WordPress authentication cookie in the response — and if they target an administrator, they own the site: plugin/theme editor access, webshell upload, database access via admin tooling, and persistent backdoors via rogue admin users or modified theme files.

Exploitation Status

At time of publication, CVE-2026-92885 is a freshly published NVD entry. Given the trivial exploitation mechanics (a single crafted POST to a universally reachable endpoint), public proof-of-concept code and mass scanning typically follow within days of disclosure for WordPress plugin auth bypasses of this class. Monitor the CISA Known Exploited Vulnerabilities catalog and assume opportunistic exploitation will begin immediately if it hasn't already. Treat exposed sites as presumptively targeted and check logs retroactively (see detection guidance below).

Detection & Response

The primary detection surface is your web access logs (Nginx/Apache) and any WAF in front of the WordPress site. The exploit is a POST to admin-ajax.php carrying action=qode_membership_check_facebook_user — a highly distinctive string with virtually no legitimate volume on sites not actively using Facebook social login, and a high-fidelity hunting signal even on sites that are.

Immediate triage questions for every WordPress site in scope:

1. Is qode-membership present in wp-content/plugins/?
2. What version is running (check qode-membership.php header or readme)?
3. Do access logs show POST requests to admin-ajax.php with the vulnerable action — especially from sources that have never authenticated to the site, in bursts, or followed by admin-area (/wp-admin/) activity from new IPs?
4. Were any new admin users created, or options (e.g., siteurl, default_role) changed, shortly after such requests?

Sigma Rules

---
title: CVE-2026-92885 Qode Membership Auth Bypass Exploitation Attempt
id: 9c1f4e27-3b8a-4d52-9f61-7a2c5e0b8413
status: experimental
description: Detects requests to the WordPress AJAX endpoint invoking the vulnerable qode_membership_check_facebook_user action used for unauthenticated account takeover in Qode Membership <= 2.0.6.2.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-92885
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri|contains: 'admin-ajax.php'
  selection_action:
    cs-uri-query|contains: 'qode_membership_check_facebook_user'
  selection_body:
    cs-body|contains: 'qode_membership_check_facebook_user'
  condition: selection_uri and 1 of selection_*
falsepositives:
  - Legitimate Facebook social login on sites actively using Qode Membership (still review until patched)
level: high
---
title: WordPress Admin-Area Access Following Suspicious AJAX Activity
id: 2f6d8b14-5a91-4c37-b8e2-9d3f6a1c7504
status: experimental
description: Detects access to WordPress administrative pages from source IPs that recently invoked the Qode Membership social-login AJAX action, indicating possible successful account takeover post-exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-92885
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_admin:
    cs-uri|contains:
      - '/wp-admin/plugin-editor.php'
      - '/wp-admin/theme-editor.php'
      - '/wp-admin/user-new.php'
      - '/wp-admin/update.php'
      - '/wp-admin/plugins.php'
  filter_known:
    c-ip|contains:
      - '10.'
      - '192.168.'
  condition: selection_admin and not filter_known
falsepositives:
  - Legitimate administrators working from remote or VPN addresses
level: medium

Tune the second rule to your environment: replace the RFC1918 filter with your actual admin IP allowlist. On a patched site, the first rule should go quiet — persistent hits after patching warrant investigation of residual plugin copies or staging environments.

KQL (Microsoft Sentinel / Defender)

If your WordPress servers forward Apache/Nginx logs or WAF events to Sentinel (via Syslog/CEF or Azure Monitor), hunt for both the exploit attempt and the follow-on session usage:

// Hunt for CVE-2026-92885 exploitation attempts and post-exploitation admin activity
union isfuzzy=true
    (Syslog
     | where ProcessName has_any ("apache", "nginx", "httpd")
     | where SyslogMessage has "admin-ajax.php" and SyslogMessage has "qode_membership_check_facebook_user"
     | extend SrcIP = extract(@'(\d{1,3}\.){3}\d{1,3}', 0, SyslogMessage)
     | project TimeGenerated, Computer, SrcIP, SyslogMessage),
    (CommonSecurityLog
     | where RequestURL has "admin-ajax.php"
       and (RequestURL has "qode_membership_check_facebook_user" or AdditionalExtensions has "qode_membership_check_facebook_user")
     | project TimeGenerated, SourceIP, RequestURL, RequestMethod, DeviceVendor)
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Attempts = count()
  by SrcIP, Computer
| where Attempts > 0
| order by FirstSeen asc

// Correlate: did the same source IP then reach wp-admin (possible successful takeover)?
let window = 1h;
let ExploitSources =
    Syslog
    | where SyslogMessage has "qode_membership_check_facebook_user"
    | extend SrcIP = extract(@'(\d{1,3}\.){3}\d{1,3}', 0, SyslogMessage)
    | summarize ExploitTime = min(TimeGenerated) by SrcIP;
Syslog
| where ProcessName has_any ("apache", "nginx", "httpd")
| where SyslogMessage has "/wp-admin/"
| extend SrcIP = extract(@'(\d{1,3}\.){3}\d{1,3}', 0, SyslogMessage)
| join kind=inner ExploitSources on SrcIP
| where TimeGenerated between (ExploitTime .. ExploitTime + window)
| project TimeGenerated, SrcIP, Computer, SyslogMessage
| order by TimeGenerated asc

Velociraptor VQL

Use this artifact across your Linux web fleet to (a) identify vulnerable Qode Membership installs and (b) grep access logs for exploitation evidence — useful when sites aren't centrally logged:

-- Hunt for vulnerable Qode Membership plugin installs and exploitation attempts in web logs
LET plugin_files = SELECT FullPath, read_file(filename=FullPath, length=4000) AS Header
FROM glob(globs='/var/www/**/wp-content/plugins/qode-membership/qode-membership.php')

LET installs = SELECT FullPath,
       parse_string_with_regex(string=Header,
          regex='Version:\\s*(?P<ver>[0-9.]+)').ver AS PluginVersion
FROM plugin_files

LET log_hits = SELECT FullPath AS LogFile, Line
FROM foreach(row={ SELECT FullPath FROM glob(globs='/var/log/{apache2,nginx,httpd}/**/*access*log*') },
  query={ SELECT FullPath, Line
          FROM parse_lines(filename=FullPath)
          WHERE Line =~ 'qode_membership_check_facebook_user' })

SELECT * FROM installs
UNION ALL
SELECT LogFile AS FullPath, Line AS PluginVersion FROM log_hits

Note: Velociraptor glob brace expansion support varies by version — if {apache2,nginx,httpd} returns nothing, run the glob three times with explicit paths and union the results.

Remediation & Verification Script (Bash)

Run this on each WordPress host (or adapt for your config-management tooling) to identify vulnerable installs, check logs for exploitation, and disable the plugin pending patch:

#!/usr/bin/env bash
# CVE-2026-92885 - Qode Membership auth bypass triage & mitigation
# Run as root or with sudo on the WordPress host.

DOCROOTS="/var/www /srv/www /home"

echo "=== [1] Locating Qode Membership installs ==="
find $DOCROOTS -type d -name "qode-membership" -path "*wp-content/plugins*" 2>/dev/null | while read -r plugdir; do
  main="$plugdir/qode-membership.php"
  ver=$(grep -m1 -iE '^\s*\*?\s*Version:' "$main" 2>/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]+(\.[0-9]+)?')
  echo "FOUND: $plugdir  version=${ver:-unknown}"
  if [ -n "$ver" ] && [ "$(printf '%s\n2.0.6.2\n' "$ver" | sort -V | head -1)" != "2.0.6.2" ]; then
    echo "  !! VULNERABLE (<= 2.0.6.2) — $plugdir"
  fi
done

echo "=== [2] Checking access logs for exploitation attempts ==="
grep -hE 'admin-ajax\.php.*qode_membership_check_facebook_user|qode_membership_check_facebook_user' \
  /var/log/apache2/*access*log* /var/log/nginx/*access*log* /var/log/httpd/*access*log* 2>/dev/null \
  | awk '{print $1, $7, $9}' | sort | uniq -c | sort -rn | head -50

echo "=== [3] If wp-cli is available, deactivate plugin until patched ==="
# For each site root found above, run (as the web user):
#   sudo -u www-data wp --path=/var/www/sitename plugin deactivate qode-membership
# After vendor patch release:
#   sudo -u www-data wp --path=/var/www/sitename plugin update qode-membership
#   sudo -u www-data wp --path=/var/www/sitename plugin activate qode-membership
echo "Manual step: deactivate qode-membership via wp-cli or rename the plugin directory:"
echo "  mv wp-content/plugins/qode-membership wp-content/plugins/qode-membership.disabled"

echo "=== [4] Audit for post-compromise indicators ==="
echo "Check for rogue admin users and recently modified PHP files:"
echo "  sudo -u www-data wp --path=<site> user list --role=administrator"
echo "  find <site>/wp-content -name '*.php' -mtime -14 -ls"

Remediation

1. Patch immediately. Update Qode Membership to the fixed release as soon as the vendor publishes it (versions 2.0.6.2 and earlier are vulnerable). Verify the installed version post-update via wp plugin list or the plugin file header. Monitor the NVD entry and the plugin's WordPress.org / vendor page for the patched version number.
2. If no patch is available yet, deactivate the plugin. wp plugin deactivate qode-membership (or rename the plugin directory) removes the AJAX action registration and closes the attack surface. On sites that depend on membership functionality, a WAF virtual patch is the fallback:
   • Block POST requests to admin-ajax.php where the body contains action=qode_membership_check_facebook_user. This breaks Facebook social login but preserves the rest of the plugin.
3. Hunt retroactively. Search access logs back at least 30 days (or to your retention limit) for the exploitation string. Any hit from an IP that isn't a known legitimate user = incident.
4. If exploitation is confirmed or suspected:
   • Force-reset all user passwords and invalidate all sessions: wp user reset-password --all (or rotate AUTH_KEY / SECURE_AUTH_KEY / LOGGED_IN_KEY / NONCE_KEY salts in wp-config.php to kill existing auth cookies).
   • Audit wp_users for rogue administrator accounts (wp user list --role=administrator).
   • Review recently modified files in wp-content (-mtime -14), check plugin-editor/theme-editor changes, cron entries (wp cron event list), and wp_options for tampered siteurl/home/default_role values.
   • Consider full credential rotation for integrated services (database, SMTP, API keys in wp-config.php).
5. Harden the platform going forward: restrict admin-ajax.php via WAF rate limiting, enforce an admin IP allowlist for /wp-admin/, deploy a WordPress-aware WAF ruleset, and put plugin inventory under continuous vulnerability management — auth bypasses in WordPress plugins are one of the most consistently exploited vulnerability classes year over year.
6. Process lesson for your dev/vendor review pipeline: this CVE exists because an undefined-variable typo silently disabled a security control. PHP linters/static analysis (PHPStan/Psalm at strict levels flag undefined variables) would have caught this before release. If you build or customize WordPress plugins, gate releases on static analysis — "security-critical guard conditions must be unreachable-proof" is a checklist item worth adding.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub