Key points
- CVE-2026-104803 is rated 9.8 CRITICAL on the CVSS scale by the National Vulnerability Database.
- The flaw affects all WPCOM Member versions up to and including 1.7.27 developed by whyun.
- Attackers can log in as any user if they know the target's bound social provider identifier.
The WPCOM Member plugin for WordPress contains a severe authentication bypass vulnerability that allows unauthenticated attackers to hijack any user account, including site administrators. The National Vulnerability Database assigns CVE-2026-104803 a CVSS score of 9.8, classifying the issue as CRITICAL. This flaw exists in every version of the plugin released up to and including 1.7.27 by developer whyun.
By the numbers
- 9.8: The CVSS base score assigned to CVE-2026-104803 by the National Vulnerability Database.
- 1.7.27: The highest version number of the WPCOM Member plugin confirmed to be vulnerable.
- 2: The number of sequential GET requests an attacker needs to forge a session and log in.
What the figures mean
The vulnerability stems from missing security checks in the plugin’s social-login callback handler, which registers on the WordPress `init` hook. According to the NVD record, the `login` function’s social-login flow performs no nonce validation, no OAuth state verification, and no per-visitor namespace isolation. This lack of verification allows an attacker to manipulate session data without proving their identity.
An attacker can exploit this by issuing a crafted GET request using the `uuid` and `code` parameters. This first request writes an attacker-named, attacker-valued entry into the global session namespace. The attacker bypasses the per-visitor prefix protection by prepending an underscore to their entry. This step effectively plants a forged credential in the system’s memory.
The second step involves issuing another GET request to trigger the `weapp_new_user()` function. This function reads the previously forged entry and resolves the attacker-supplied `openid` value to a bound WordPress account. Once this resolution occurs, the `wp_set_auth_cookie()` function establishes a fully authenticated session for the victim. The attacker gains access without knowing the victim's password.
Successful exploitation requires two conditions. First, the target site must have at least one social provider configured, which activates the vulnerable handler. Second, the attacker must know or be able to enumerate the victim account’s bound `openid` or `unionid`. If these social provider identifiers are discoverable, the attacker can impersonate any associated WordPress user, regardless of their privilege level.
What to watch
Security teams should monitor for unauthorized administrative actions, especially those originating from sessions established via social login endpoints. The NVD record indicates that the vulnerability allows access to any user whose social identifier is known. This means that high-profile accounts with publicly linked social profiles are at higher risk.
Organizations should also audit their social login configurations. The vulnerability is only active when a social provider is configured. Disabling unused social login options reduces the attack surface. However, this does not mitigate the risk for sites that rely on social authentication for user access.
No patch has been confirmed yet. Users running WPCOM Member version 1.7.27 or earlier remain exposed to this critical authentication bypass. Administrators should prepare to restrict access to the social-login callback handler until a fix is available from the vendor.
What to do and how to stay safe: WPCOM Member
- Review access logs for the social-login callback endpoint to detect crafted GET requests with unusual `uuid` or `code` parameters.
- Restrict access to the WordPress admin area by IP address or by requiring multi-factor authentication for all users, especially administrators.
- Audit social provider configurations and disable any unused social login options to reduce the attack surface.
- Monitor for new sessions established via social login that do not match expected user behavior or geographic locations.
Step-by-step guide: Patch Management Implementation: A Step-by-Step Rollout Plan
General security guidance from the Sandbox Gazette newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of WPCOM Member are affected by this vulnerability?
All versions up to and including 1.7.27 are vulnerable to CVE-2026-104803, according to the National Vulnerability Database.
Does an attacker need a password to exploit this flaw?
No, the vulnerability allows unauthenticated attackers to bypass authentication entirely by forging session entries.
Is there a patch available for CVE-2026-104803?
No fix has been confirmed yet; users should monitor vendor announcements for an update.
