WPCOM Member Plugin Critical Auth Bypass Lets Attackers Hijack Admin Accounts

The WPCOM Member plugin for WordPress contains a critical authentication bypass vulnerability that allows unauthenticated attackers to log in as any user, including site administrators. The flaw, tracked as CVE-2026-104803, affects all plugin versions up to and including 1.7.27 and has been assigned a CVSS score of 9.8, indicating a severe risk to WordPress installations using this specific social login tool.

According to the National Vulnerability Database record, the vulnerability stems from missing security controls in the plugin's social-login callback handler. The handler is registered on the `init` hook and processes `uuid` and `code` parameters without performing nonce validation, OAuth state verification, or per-visitor namespace isolation in the session store. This lack of validation enables an attacker to manipulate session data through crafted requests.

Technical Context and Exploitation

The exploitation process involves two distinct GET requests issued by an unauthenticated attacker. First, the attacker sends a request that writes an attacker-named and attacker-valued entry into the global session namespace. This is achieved by bypassing the per-visitor prefix mechanism through the use of an underscore character. This step allows the attacker to inject arbitrary data into the session store without proper authentication.

The second request triggers the `weapp_new_user()` function, which reads the forged session entry. This function resolves the attacker-supplied `openid` value to a bound WordPress account. Once this resolution occurs, the `wp_set_auth_cookie()` function establishes a fully authenticated session for the attacker. This sequence effectively allows the attacker to assume the identity of any WordPress user whose bound social provider identifier is known or can be discovered through enumeration.

Affected Systems and Requirements

The vulnerability is present in the WPCOM Member plugin developed by whyun. It affects all versions of the software up to and including version 1.7.27. Any WordPress site that has installed this plugin within that version range is potentially vulnerable, provided that the site has configured at least one social provider. The configuration of a social provider is a necessary condition because it activates the vulnerable callback handler that processes the social login flow.

Successful exploitation requires that the attacker knows or can enumerate the victim account's bound `openid` or `unionid`. These identifiers link the WordPress user account to the external social provider. If these identifiers are not discoverable, the attack vector is significantly hindered. However, if the identifiers are exposed through public profiles or other means, the risk of account takeover increases substantially for administrators and other users.

What should you do?

Site administrators should immediately audit their WordPress installations to determine if the WPCOM Member plugin is installed and check its current version. If the plugin version is 1.7.27 or older, the site is vulnerable to this critical authentication bypass. Administrators should review access logs for unusual login patterns or unexpected session creations, particularly those originating from unauthenticated sources. Monitoring for requests containing `uuid` and `code` parameters in the callback handler can help detect active exploitation attempts.