Critical Auth Bypass in WPCOM Member Plugin (CVE-2026-104803)
The WPCOM Member plugin for WordPress is vulnerable to an authentication bypass that lets unauthenticated attackers log in as any WordPress user — including administrators. Tracked as CVE-2026-104803 and affecting all versions up to and including 1.7.27, the flaw sits in the plugin’s social-login callback handler. The WPCOM Member auth bypass is about as bad as a login flaw gets: no password, no phishing, and no logged-in victim are required.
What Happened: the WPCOM Member Auth Bypass, Explained
The vulnerability lives in the social-login callback handler that WPCOM Member registers on WordPress’s init hook, reachable through its uuid and code parameters. At the heart of the WPCOM Member auth bypass are three missing security checks in the login function’s social-login flow: no nonce validation, no OAuth state verification, and no per-visitor namespace isolation in the plugin’s session store.
In plain English, the attack works in two crafted requests. The first GET request writes an attacker-chosen name and value into the plugin’s global session namespace — sidestepping the per-visitor prefix simply by prepending an underscore. The second GET request triggers the plugin’s weapp_new_user() routine, which reads that forged session entry and resolves the attacker-supplied social identifier (an openid or unionid value) to a bound WordPress account. WordPress then calls wp_set_auth_cookie() and hands the attacker a fully authenticated session. The attacker never supplies a password and never completes a real OAuth flow; the plugin’s own machinery does the logging in.
The flaw is classified as CWE-287 (Improper Authentication) and carries a CVSS v3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — the worst-case combination of network-reachable, low complexity, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability, rated Critical. TheHackerWire’s EPSS data puts the predicted probability of exploitation in the next 30 days at 0.45% — low in absolute terms, though higher than 38% of all tracked CVEs. Wordfence included wpcom-member in its weekly WordPress vulnerability report for October 5–11, 2026.
Who Is Affected by the WPCOM Member Auth Bypass
Two preconditions gate the WPCOM Member auth bypass. First, the target site must have at least one social provider configured, because that is what activates the vulnerable callback handler. Sites running WPCOM Member purely as a membership plugin without social login do not expose this code path. Second, the attacker must know or be able to enumerate the victim account’s bound social provider identifier — the openid or unionid value. The openid/unionid terminology and the weapp_new_user() function name point to WeChat-style social login integrations, which is where this plugin sees its heaviest use.
Any site meeting both conditions is exposed to the WPCOM Member auth bypass, and the prize is total: the attacker can choose to log in as any user on the site, including administrators. Membership and community sites — the plugin’s core audience — are the natural targets, since they combine large user bases with social-login convenience features.
Why the WPCOM Member Auth Bypass Matters
Authentication bypasses are the most consequential class of web flaw because they collapse every other control. Firewalls, hardened passwords, and two-factor authentication all assume the login gate itself works; this flaw walks around the gate entirely with two GET requests. Once logged in as an administrator, an attacker can install plugins, create users, exfiltrate data, or plant persistent backdoors — the full takeover playbook.
Social login deserves special attention here. Users connect their social accounts expecting the OAuth dance — provider redirects, state tokens, verified identities — to protect them. This flaw shows what happens when a plugin reimplements that dance and skips the verification steps: the convenience feature becomes the attack surface. Site owners should also not take comfort in the low EPSS score alone. Authentication bypasses are among the fastest flaws to weaponize once proof-of-concept code circulates, because the exploit is simple, reliable, and leaves minimal forensic trace compared with multi-stage attacks. For plugin developers, the WPCOM Member auth bypass is a case study in why social-login code paths deserve the same adversarial review as password flows.
What to Do Now After the WPCOM Member Auth Bypass Disclosure
Treat the WPCOM Member auth bypass as a patch-now emergency if your site meets the preconditions.
- Update WPCOM Member immediately to the latest release past version 1.7.27. This is the only complete fix.
- If you cannot update right away, disable social login or deactivate the plugin entirely as a stopgap — without an active social provider, the vulnerable handler is not reachable.
- Audit user accounts. Look for unexpected administrator accounts, changed account emails, and new users you did not create.
- Review access logs for crafted requests hitting the social-login callback with suspicious
uuidandcodeparameters, especially paired requests seconds apart. - Force-logout all users, reset WordPress salts, and rotate administrator passwords to invalidate any sessions an attacker may have established.
- Check for persistence: unknown plugins, files in the must-use plugins directory, and unexpected scheduled tasks or cron entries.
- If compromise is confirmed, restore from a known-clean backup taken before the exposure window, then re-apply the patched plugin.
WPCOM Member Auth Bypass: Frequently Asked Questions
Which versions are affected?
All versions of WPCOM Member up to and including 1.7.27. Update to the latest release past 1.7.27.
Am I at risk if I don’t use social login?
No — the vulnerable handler only activates when at least one social provider is configured. But if you are unsure, check the plugin’s settings rather than assuming.
Has this been exploited in the wild?
No confirmed in-the-wild exploitation has been reported in the sources reviewed for this article. The EPSS score of 0.45% suggests low near-term probability, but auth bypasses can move fast once exploit code appears.
What is the single most important step?
Update the plugin to close the WPCOM Member auth bypass. Everything else — log review, session resets, account audits — is verification that the update came in time.
WPCOM Member Auth Bypass: Conclusion
The WPCOM Member auth bypass (CVE-2026-104803) is a reminder that login code is the last place a site can afford missing checks. Three absent validations — no nonce check, no OAuth state verification, no session namespace isolation — were enough to let an unauthenticated attacker log in as any user, including administrators, with two crafted requests. The CVSS vector is the worst case on every axis, and while the predicted exploitation probability is currently low, the simplicity of the attack means that could change quickly. If your site runs WPCOM Member 1.7.27 or older with social login configured, update past 1.7.27 today, then audit accounts and logs for signs the flaw was used before you patched.
Authentication and login-flow flaws are exactly the kind of thing that slip past routine maintenance. Qamar Digital Ventures LLC‘s website care plans include security monitoring and timely updates, so vulnerabilities like this get patched before they become breaches. Visit https://qamardigitalventuresllc.com/ to learn more, or contact us to discuss a care plan for your site.
