{"metadata": {"vulnerability": "CVE-2026-92885", "count": 25, "kinds": {"milestone": 4, "sighting": 11, "kev": 0, "other": 10}}, "data": [{"timestamp": "2026-09-17T08:43:22.230Z", "date_only": false, "value": "2026-09-17T08:43:22.230Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-92885", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-17T14:31:02Z", "date_only": false, "value": "2026-09-17T14:31:02.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-92885", "field": "containers.cna.timeline.0.time"}, {"timestamp": "2026-10-26T20:13:22Z", "date_only": false, "value": "2026-10-26T20:13:22.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-92885", "field": "containers.cna.timeline.1.time"}, {"timestamp": "2026-10-27T08:28:43.933Z", "date_only": false, "value": "2026-10-27T08:28:43.933Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-92885", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-27T08:28:43.933Z", "date_only": false, "value": "2026-10-27T08:28:43.933Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-92885", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-27T08:37:19.967Z", "date_only": false, "value": "2026-10-27T08:37:19.967581Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117511961930827257", "record": "CVE-2026-92885", "field": "creation_timestamp", "uuid": "32c14bc3-06d2-4f45-b324-62adc581b9a1", "content": "CVE-2026-92885 Qode Membership <= 2.0.6.2 - Authentication Bypass via Social Login The Qode Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 2.0.6.2 via the qode_membership_check_facebook_user AJAX action. This is due to a typographic error in the Facebook OAuth token verification guard within the qode_membership_login_user_from_social_network function \u2014 the guard condition tests an undefined variable ($check_social_useqoder instead of $check_social_user), causing empty() to always return true and rendering the Graph API token verification branch dead code, leaving wp_set_auth_cookie() reachable with no credential or token validation whatsoever. This makes it possible for unauthenticated attackers to log in as any existing WordPress account \u2014 including Administrator-level accounts \u2014 by supplying a known or enumerated administrator login name (rather than an email address) in the response[email] parameter, which the fallback path in get_user_by('login', $email) resolves to the matching account. Exploitation does require harvesting a valid qode_validate_facebook_login nonce, but this nonce is rendered on any public front-end page containing the [qode_user_login] or [qode_user_register] shortcode and is therefore obtainable without any prior authentication.\nhttps://www.cve.org/CVERecord?id=CVE-2026-92885https://www.wordfence.com/threat-intel/vulnerabilities/id/26bca6c2-0999-4cf6-9c4e-ddaf528ef808?source=cvehttps://themeforest.net/item/bridge-creative-multipurpose-wordpress-theme/7315054#QodeThemes #QodeMembership#CVE_2026_92885#bot", "url": "https://infosec.exchange/users/cve/statuses/117511961930827257"}, {"timestamp": "2026-10-27T09:00:25.942Z", "date_only": false, "value": "2026-10-27T09:00:25.942263Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/117512052744217349", "record": "cve-2026-92885", "field": "creation_timestamp", "uuid": "efc87524-2c86-4839-9357-2bc24796116b", "content": "CVE-2026-92885: Qode Membership plugin (\u22642.0.6.2) suffers a CRITICAL auth bypass (CVSS 9.8). Typo in Facebook OAuth check lets attackers hijack any WordPress account \u2014 including admins. Remove or restrict plugin use now. https://radar.offseq.com/threat/cve-2026-92885-cwe-287-improper-authentication-in-qode-themes-qode-membership-038e4dcfed22c95b #OffSeq #WordPress #Vuln", "url": "https://infosec.exchange/users/offseq/statuses/117512052744217349"}, {"timestamp": "2026-10-27T09:00:27.990Z", "date_only": false, "value": "2026-10-27T09:00:27.990931Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mytuqrc2da2e", "record": "cve-2026-92885", "field": "creation_timestamp", "uuid": "df2d55ef-0041-401b-9753-af972446faa2", "content": "Qode Membership plugin (\u22642.0.6.2) hit by CRITICAL auth bypass (CVE-2026-92885, CVSS 9.8). Unauthenticated attackers can take over admin accounts. Remove or restrict plugin ASAP. https://radar.offseq.com/threat/cve-2026-92885-cwe-287-improper-authentication-in-qode-themes-qode-membership-038e4dcfe...", "url": "https://bsky.app/profile/offseq.bsky.social/post/3mytuqrc2da2e"}, {"timestamp": "2026-10-27T09:16:34Z", "date_only": false, "value": "2026-10-27T09:16:34Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-HJ69-4738-F2V2", "record": "GHSA-HJ69-4738-F2V2", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-27T09:16:34.630Z", "date_only": false, "value": "2026-10-27T09:16:34.630", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-92885", "record": "FKIE_CVE-2026-92885", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-27T09:30:04.250Z", "date_only": false, "value": "2026-10-27T09:30:04.250295Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mytwfpm3pf2t", "record": "CVE-2026-92885", "field": "creation_timestamp", "uuid": "0e60cb4b-1e3f-45c5-ae53-7d01db5ee14e", "content": "CVE-2026-92885 - qode membership\nThe Qode Membership add\u2011on for WordPress can be tricked into signing in anyone without checking their Facebook credentials. An error in the code means the safety\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#qodemembership #qodethemes #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mytwfpm3pf2t"}, {"timestamp": "2026-10-27T09:30:59Z", "date_only": false, "value": "2026-10-27T09:30:59Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-HJ69-4738-F2V2", "record": "GHSA-HJ69-4738-F2V2", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-27T09:30:59Z", "date_only": false, "value": "2026-10-27T09:30:59Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-HJ69-4738-F2V2", "record": "GHSA-HJ69-4738-F2V2", "field": "modified"}, {"timestamp": "2026-10-27T09:33:06.263Z", "date_only": false, "value": "2026-10-27T09:33:06.263792Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/veduis.bsky.social/post/3mytwl55hxw2z", "record": "CVE-2026-92885", "field": "creation_timestamp", "uuid": "30ee14c6-e185-488a-8285-5648b36c3aef", "content": "Qode Membership for WordPress is vulnerable to authentication bypass under CVE-2026-92885. Severity is rated CRITICAL.", "url": "https://bsky.app/profile/veduis.bsky.social/post/3mytwl55hxw2z"}, {"timestamp": "2026-10-27T10:07:14.172Z", "date_only": false, "value": "2026-10-27T10:07:14.172269Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mytyi6mkhf2w", "record": "CVE-2026-92885", "field": "creation_timestamp", "uuid": "7d343469-0851-4b7b-b603-4f545514ca87", "content": "\ud83d\udea8 CVE-2026-92885 \u2014 CVSS 9.8 CRITICAL\n\nThe Qode Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-92885\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mytyi6mkhf2w"}, {"timestamp": "2026-10-27T11:36:15.083Z", "date_only": false, "value": "2026-10-27T11:36:15.083721Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/threatroundup.bsky.social/post/3myu5hdyhjc2t", "record": "CVE-2026-92885", "field": "creation_timestamp", "uuid": "1e29064a-7826-44f5-97f6-152ad6584ecf", "content": "Qode Themes Qode Membership CVE-2026-92885 is rated critical, CVSS 9.8. The Qode Membership plugin for WordPress is vulnerable to Authentication Bypass leading to\u2026 No public exploit reported yet. Check your exposure. #CVE #PatchManagement\n\nthreatroundup.com/cve/cve-2026...", "url": "https://bsky.app/profile/threatroundup.bsky.social/post/3myu5hdyhjc2t"}, {"timestamp": "2026-10-27T12:00:12.669Z", "date_only": false, "value": "2026-10-27T12:00:12.669305Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pulse-wp.com/post/3myu6s72hnw2z", "record": "CVE-2026-92885", "field": "creation_timestamp", "uuid": "c8e1aca4-58a1-4da1-9e70-58ea00ac2de5", "content": "CVE-2026-92885. CVSS 9.8. Qode Membership has a typo in OAuth verification. Any visitor hijacks any account. No credentials needed.\n\nUpdate to 2.0.6.2 now.\n\nScan your WordPress site: pulse-wp.com\n#WordPress #CVE #CyberSecurity", "url": "https://bsky.app/profile/pulse-wp.com/post/3myu6s72hnw2z"}, {"timestamp": "2026-10-27T13:52:13.073Z", "date_only": false, "value": "2026-10-27T13:52:13.073395Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-92885", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-27T13:52:13.073Z", "date_only": false, "value": "2026-10-27T13:52:13.073395Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-92885", "record": "FKIE_CVE-2026-92885", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-27T14:13:43.451Z", "date_only": false, "value": "2026-10-27T14:13:43.451Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-92885", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-27T14:13:43.451Z", "date_only": false, "value": "2026-10-27T14:13:43.451Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-92885", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-27T14:52:13.410Z", "date_only": false, "value": "2026-10-27T14:52:13.410", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-92885", "record": "FKIE_CVE-2026-92885", "field": "lastModified"}, {"timestamp": "2026-10-27T15:28:28.485Z", "date_only": false, "value": "2026-10-27T15:28:28.485539Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3myukglt7ee2c", "record": "CVE-2026-92885", "field": "creation_timestamp", "uuid": "d0a352f0-f0d3-40d0-b82b-a201f90dbf4a", "content": "Qode Membership plugin\uff08WordPress\uff09\u3067\u8a8d\u8a3c\u30d0\u30a4\u30d1\u30b9\u306e\u8106\u5f31\u6027\u304c\u3042\u308a\u3001\u5168\u30d0\u30fc\u30b8\u30e7\u30f3\u3067\u30a2\u30ab\u30a6\u30f3\u30c8\u4e57\u3063\u53d6\u308a\u306e\u53ef\u80fd\u6027\u3002\u653b\u6483\u8005\u306f\u6b63\u898f\u306enonce\u304c\u3042\u308c\u3070\u3001\u4efb\u610f\u306e\u30e6\u30fc\u30b6\u30fc\uff08\u7ba1\u7406\u8005\u542b\u3080\u2026\nCVE-2026-92885 CVSS 9.8 | CRITICAL", "url": "https://bsky.app/profile/postac001.bsky.social/post/3myukglt7ee2c"}, {"timestamp": "2026-10-27T18:15:13.400Z", "date_only": false, "value": "2026-10-27T18:15:13.400518Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alt.pds.lefht.cc/post/3myutqqg6ik2k", "record": "CVE-2026-92885", "field": "creation_timestamp", "uuid": "d84d9ce8-ae74-409c-af13-bd81bf7d84d5", "content": "\ud83d\udee1\ufe0f Most-discussed CVEs on Bluesky, last 24h\n\n1. CVE-2026-109618 \u00b7 53 people \ud83d\udd25\n2. CVE-2026-111497 \u00b7 49 people\n3. CVE-2026-109619 \u00b7 40 people \ud83d\udd25\n4. CVE-2026-80097 \u00b7 12 people\n5. CVE-2026-92885 \u00b7 7 people\n\n\ud83d\udd25 = on CISA's Known Exploited list \u00b7 details in the thread \ud83e\uddf5", "url": "https://bsky.app/profile/alt.pds.lefht.cc/post/3myutqqg6ik2k"}, {"timestamp": "2026-10-27T18:15:15.706Z", "date_only": false, "value": "2026-10-27T18:15:15.706048Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alt.pds.lefht.cc/post/3myutqqz2yc2k", "record": "CVE-2026-92885", "field": "creation_timestamp", "uuid": "75a268c5-bde0-45af-976b-6e9c873b4ef2", "content": "5. CVE-2026-92885 \u00b7 7 people\n\ud83d\udfe5 Critical 9.8 \u00b7 Qode Membership\n\nQode Membership <= 2.0.6.2 - Authentication Bypass via Social Login", "url": "https://bsky.app/profile/alt.pds.lefht.cc/post/3myutqqz2yc2k"}], "metrics": {"as_of": "2026-10-30T21:13:13.305Z", "anchors": {"origin": {"timestamp": "2026-10-27T08:28:43.933Z", "date_only": false, "value": "2026-10-27T08:28:43.933Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-92885", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-27T08:28:43.933Z", "date_only": false, "value": "2026-10-27T08:28:43.933Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-92885", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 305069.372549, "hours": 84.74149237472223, "days": 3.5308955156134263, "min_seconds": 305069.372549, "max_seconds": 305069.372549, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-27T08:28:43.933Z", "date_only": false, "value": "2026-10-27T08:28:43.933Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-92885", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-30T21:13:13.305Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}