CVE-2026-104803: CWE-287 Improper Authentication in whyun WPCOM Member

CVE-2026-104803 describes an authentication bypass vulnerability in the WPCOM Member WordPress plugin versions up to 1.7.27. The issue exists in the social-login callback handler registered on the 'init' hook, where the login function's social-login flow lacks nonce validation, OAuth state verification, and per-visitor session namespace isolation. An attacker can send a crafted GET request to write a malicious entry into the global session namespace, bypassing visitor-specific prefixes. A subsequent GET request triggers the plugin to read this forged entry, resolving the attacker-supplied openid to a WordPress account and establishing an authenticated session via wp_set_auth_cookie(). This allows unauthenticated attackers to impersonate any user whose social provider identifier is known or discoverable, including administrators. The vulnerability requires the site to have at least one social provider configured to activate the vulnerable handler.

Successful exploitation results in full authentication bypass, allowing attackers to log in as any WordPress user, including administrators. This compromises confidentiality, integrity, and availability of the affected WordPress site, potentially leading to complete site takeover. The CVSS v3.1 base score is 9.8 (Critical), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling social login features or removing the WPCOM Member plugin if feasible. Monitor vendor channels for updates and apply patches promptly once released.