Threats tagged 'ghsa-hj69-4738-f2v2'

The Qode Membership plugin for WordPress versions up to and including 2.0.6.2 contains an authentication bypass vulnerability due to a typographic error in Facebook OAuth token verification. This flaw allows unauthenticated attackers to bypass token validation and log in as any existing WordPress user, including administrators, by exploiting a publicly accessible nonce. The vulnerability arises from an undefined variable causing the token verification check to be skipped, enabling account takeover.