WordPress Qode Membership Plugin Authentication Bypass Vulnerability

The Qode Membership plugin for WordPress is vulnerable to an Authentication Bypass leading to account takeover. The flaw affects all versions up to and including 2.0.6.2, via the qode_membership_check_facebook_user AJAX action.

Inside qode_membership_login_user_from_social_network, a typographic error in the Facebook OAuth token verification guard tests an undefined variable ($check_social_useqoder instead of $check_social_user). As a result, empty() always returns true, the Graph API token verification branch is dead code, and wp_set_auth_cookie() is reachable with no credential or token validation.

• Attackers can log in as any existing WordPress account, including Administrator-level accounts, by supplying a known or enumerated administrator login name in the response[email] parameter.
• The fallback path in get_user_by('login', $email) resolves that name to the matching account.
• Exploitation requires harvesting a valid qode_validate_facebook_login nonce, but it is rendered on any public front-end page containing the [qode_user_login] or [qode_user_register] shortcode, so no prior authentication is needed.