CVE-2026-18056: CWE-287 Improper Authentication in hivepress HivePress Authentication

CVE-2026-18056 is an authentication bypass vulnerability in the HivePress Authentication WordPress plugin. The vulnerability occurs because the authenticate_user function forwards the attacker-supplied Facebook access_token to the Facebook Graph API and trusts the returned email and ID without performing critical validations such as /debug_token verification or checking that the token's app_id matches the configured hp_facebook_app_id. This improper authentication (CWE-287) enables an attacker who has obtained a valid Facebook access token for a victim's account to impersonate that user within WordPress, potentially gaining administrative access.

Successful exploitation allows unauthenticated attackers to bypass authentication and log in as any existing WordPress user whose email is linked to a Facebook account for which the attacker can obtain a valid access token. This includes administrative users, leading to full compromise of the WordPress site. The vulnerability impacts confidentiality, integrity, and availability of the affected system.

No official patch or remediation has been confirmed at this time. Users should monitor the vendor's advisory for updates. Until a fix is available, restrict access to the plugin and consider disabling Facebook authentication to reduce risk. Note that exploitation requires the attacker to obtain a valid Facebook access token for the targeted user, which may limit attack feasibility.