the WPCOM Member authentication bypass (CVE-2026-104803): Log In as Anyone, No Password Required
The WPCOM Member plugin for WordPress is vulnerable to an authentication bypass that lets unauthenticated attackers log in as any WordPress user — including administrators. Tracked as CVE-2026-104803 and affecting all versions up to and including 1.7.27, the WPCOM Member authentication bypass (CVE-2026-104803) flaw carries a CVSS score of 9.8, putting it in the critical tier. The attack is elegant in the worst way: two crafted GET requests, no credentials, no social account of the attacker’s own — just a forged session entry and a plugin that trusts it. If you run WPCOM Member with social login configured, the WPCOM Member authentication bypass makes this a drop-everything update.
What Happened with the WPCOM Member authentication bypass (CVE-2026-104803)
The WPCOM Member authentication bypass (CVE-2026-104803) vulnerability lives in the plugin’s social-login callback handler, which is registered on WordPress’s init hook. That handler accepts uuid and code parameters, and the login function’s social-login flow performs none of the three checks that secure OAuth-style callbacks: no nonce validation, no OAuth state verification, and no per-visitor namespace isolation in its session store.
Here is how the exploit works, in plain terms. First, the attacker issues a crafted GET request that writes an attacker-named, attacker-valued entry into the plugin’s global session namespace. Normally, session entries are isolated per visitor with a prefix — but the attacker bypasses that isolation simply by prepending an underscore to the entry name, a one-character trick that the code does not account for. Second, the attacker issues another GET request that triggers the weapp_new_user() function, which reads the forged entry and resolves the attacker-supplied openid value to a bound WordPress account. WordPress then calls wp_set_auth_cookie() — the same function that logs in a legitimate user — and establishes a fully authenticated session. The attacker is now logged in as the victim.
Two conditions gate the attack. The target site must have at least one social provider configured — which is what activates the vulnerable handler in the first place. And the attacker must know or be able to discover the victim account’s bound social provider identifier (an openid or unionid). That second requirement is the main practical barrier: openids are not public by default, but they can leak through provider APIs, exposed user metadata, or enumeration techniques. For a targeted attacker who wants a specific administrator’s session, that barrier is surmountable enough to pull off the WPCOM Member authentication bypass.
Patchstack published the WPCOM Member authentication bypass disclosure on October 9, 2026, rated it CVSS 9.8, and noted that vulnerabilities of this class are the ones used in mass-exploit campaigns — attackers probe thousands of sites at a time regardless of traffic size. Patchstack has issued a virtual-patch mitigation rule for its users, and the fix is to update to version 1.8.0 or later.
Who Is Affected by the WPCOM Member authentication bypass (CVE-2026-104803)
The WPCOM Member authentication bypass (CVE-2026-104803) exposure is sharply defined. Check your site against these criteria:
- Sites running WPCOM Member 1.7.27 or earlier with at least one social login provider configured. This is the exposed group. The vulnerable handler only activates when a social provider is configured, so a WPCOM Member install with social login disabled is not reachable through this path.
- Sites where administrator or editor accounts have bound social identifiers. The attack resolves an attacker-supplied openid to a bound WordPress account — any user with a bound social identifier, including admins, can be impersonated. If your admin account uses social login, you are the highest-value target.
- Sites already on 1.8.0 or later. You carry the fix. Keep the plugin updated.
- Sites that were exposed before patching. An authentication bypass leaves no broken pages behind — a successful attack looks exactly like a legitimate admin login. If you were on a vulnerable version with social login configured, you should investigate session logs for logins you cannot explain, not just update and move on.
Why the WPCOM Member authentication bypass (CVE-2026-104803) Matters
The WPCOM Member authentication bypass (CVE-2026-104803) flaw matters because it breaks the single most important promise a login system makes: that only the account owner can become the account owner. A 9.8 CVSS authentication bypass is not a data leak or a defacement risk — it is a full account takeover primitive, and against administrator accounts it is a full site takeover primitive. The attacker inherits every capability of the victim: publishing, user management, plugin installation, code execution through the theme editor.
The technical details carry a broader lesson for plugin developers. The vulnerability is a compound of three missing checks — no nonce, no OAuth state, no session namespace isolation — any one of which would have broken the exploit chain. Social login integrations are deceptively hard to get right because they bridge two trust domains: the external provider and the local session. Each missing verification is a small omission; together they are a critical vulnerability. The underscore-prefix bypass of the per-visitor session isolation is particularly instructive: a namespace boundary that can be crossed by naming convention alone is not a boundary at all.
There is also a detection problem worth naming. Unlike a defacement or a spam injection, a forged admin session is invisible in the site’s content. It appears in access logs as a normal login, possibly from an unusual IP or at an unusual hour — signals that require someone to be watching. Sites without login monitoring or anomaly alerting would never know the attack happened. That is why the response to this CVE must include investigation, not just patching.
What to Do Now About the WPCOM Member authentication bypass (CVE-2026-104803)
Treat the WPCOM Member authentication bypass as urgent. Work through these steps:
- Update WPCOM Member to 1.8.0 or later immediately. This is the vendor fix. If you use Patchstack, its mitigation rule blocks attack attempts at the traffic layer — enable it as a bridge, but still update, because virtual patching is a seatbelt, not a repair.
- Investigate for unauthorized access. Review your login and session logs for the period you were exposed. Look for admin logins from unfamiliar IP addresses, at unusual hours, or via the social-login flow when the legitimate admin normally uses password login. Check for new administrator accounts, unexpected user role changes, and unfamiliar files or plugin installations.
- Rotate credentials and session secrets. If you find any sign of compromise — or cannot rule it out — force-logout all users, rotate every administrator password, change WordPress salts, and rotate database and hosting credentials. An attacker who held an admin session may have planted persistence mechanisms.
- Reassess your social login configuration. After patching, review which providers are configured and which accounts have bound social identifiers. Remove providers you do not actively use, unbind social identifiers from high-privilege accounts where social login is not needed, and consider whether administrator accounts should log in via social providers at all.
the WPCOM Member authentication bypass (CVE-2026-104803): Frequently Asked Questions
What is the WPCOM Member authentication bypass (CVE-2026-104803)?
It is a critical (CVSS 9.8) unauthenticated authentication bypass in the WPCOM Member WordPress plugin, affecting versions up to and including 1.7.27. Attackers can log in as any user — including administrators — by forging session entries through the plugin’s social-login callback handler.
How does the attack work?
The attacker sends a crafted GET request that writes a forged entry into the plugin’s global session namespace (bypassing per-visitor isolation with an underscore prefix), then a second request that resolves an attacker-supplied social identifier to a WordPress account. WordPress then sets a fully authenticated session cookie. No password or attacker-owned social account is needed for the WPCOM Member authentication bypass.
What version fixes CVE-2026-104803?
Update to WPCOM Member 1.8.0 or later. Patchstack users can also enable the virtual-patch mitigation rule as temporary protection.
I updated — am I safe?
The update stops future attacks, but a forged admin session leaves no visible damage. If your site was exposed with social login configured, review login logs for unexplained admin sessions and rotate credentials. When in doubt, investigate as a possible compromise.
Conclusion
the WPCOM Member authentication bypass (CVE-2026-104803) is the kind of vulnerability that justifies the entire concept of urgent security updates: no credentials required, administrator accounts reachable, and an attack that looks like a normal login in the logs. The two-request exploit chain — forge a session entry, resolve it to an account — is a reminder that login code is the highest-stakes code on any site, and that social login integrations must validate nonces, verify OAuth state, and isolate session namespaces as non-negotiable basics. Update to 1.8.0, investigate your exposure window, and rotate anything an impersonated admin could have touched. Login security is not the place for “we’ll get to it next week” — not with the WPCOM Member authentication bypass in the wild. If you want updates, monitoring, and login-anomaly checks handled by a team that treats them as urgent by default, Qamar Digital Ventures LLC‘s website care plans are built for exactly that — Concerned the WPCOM Member authentication bypass was exploited on your site? contact us for an incident review. Visit https://qamardigitalventuresllc.com/ to see what’s included.
