WPCOM Member CVSS 9.8 Flaw Enables Unauthenticated Account Takeover via Social Login Validation Gap
Unauthenticated attackers can take over any WordPress account, including administrators, by exploiting missing validation in the WPCOM Member plugin’s social login flow.
Key points
- The vulnerability affects WPCOM Member versions up to and including 1.7.27.
- The National Vulnerability Database rates the flaw CVSS 9.8, a critical severity.
- Attackers need a target site with social login enabled and a known user identifier.
The WPCOM Member plugin for WordPress contains a critical authentication bypass flaw that allows unauthenticated attackers to log in as any user on an affected site. This vulnerability, tracked as CVE-2026-104803, impacts all plugin versions up to and including 1.7.27, according to the National Vulnerability Database.
The flaw exists within the social-login callback handler registered on the `init` hook. The plugin’s `login` function fails to perform nonce validation, OAuth state verification, or per-visitor namespace isolation in the session store. This lack of security controls enables attackers to manipulate session data and establish authenticated sessions without valid credentials.
How the authentication bypass works
An attacker exploits the vulnerability by issuing a crafted GET request to the `uuid` and `code` parameters. This request writes a forged entry into the global session namespace by bypassing the per-visitor prefix with an underscore. The attacker then sends a second GET request to trigger the `weapp_new_user()` function, which reads the forged entry.
The `weapp_new_user()` function resolves the attacker-supplied `openid` value to a bound WordPress account. This resolution occurs before `wp_set_auth_cookie()` establishes a fully authenticated session. Consequently, the attacker gains access to the account associated with that social provider identifier, effectively bypassing standard login procedures.
Who is affected by this flaw
Successful exploitation requires two specific conditions on the target WordPress site. First, the site must have at least one social provider configured, as this activates the vulnerable handler. Second, the attacker must know or be able to enumerate the victim account’s bound `openid` or `unionid`.
The vulnerability affects any WordPress installation using WPCOM Member versions 1.7.27 or earlier. Because the flaw allows access to any user whose social identifier is known, administrators are at significant risk if their social login credentials are discoverable. The National Vulnerability Database classifies the underlying weakness as CWE-287, improper verification of Cryptographic Data.
Our take on the response
The severity of this flaw stems from the complete lack of session validation in the social login flow. By allowing unauthenticated requests to write to the global session namespace, the plugin exposes all bound accounts to takeover. Security teams should treat any site with social login enabled as potentially compromised if they are running vulnerable versions.
WHAT TO DO
- Audit WordPress installations to identify sites using WPCOM Member versions 1.7.27 or older.
- Verify if social login providers are enabled on vulnerable sites, as this activates the attack surface.
- Monitor authentication logs for unusual login patterns or sessions established without prior credential entry.
- Once the vendor provides an update, apply it immediately to patch the authentication bypass vulnerability.
What to do and how to stay safe: WPCOM Member
- Automation misses business logic flaws that require human reasoning to detect.
- Patching speed matters less than understanding which vulnerabilities actually expose your data.
- Delegating infrastructure management reduces the burden of constant security updates.
Prioritize vulnerabilities by combining automated data with human context to protect your most critical assets. Delegate routine patching to experts while retaining control over your security strategy.
Step-by-step guide: Vulnerability Prioritization for Small Businesses
General security guidance from the DataSafe Radar newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for the WPCOM Member authentication bypass?
The National Vulnerability Database rates CVE-2026-104803 with a CVSS score of 9.8, which is classified as Critical.
Does an attacker need to log in to exploit this vulnerability?
No, the vulnerability allows unauthenticated attackers to bypass authentication and log in as any user, including administrators.
Which versions of WPCOM Member are vulnerable to this flaw?
All versions of the WPCOM Member plugin up to and including version 1.7.27 are affected by this authentication bypass.
