CVE-2026-104803

The WPCOM Member plugin for WordPress (versions up to and including 1.7.27 ) is vulnerable to an Authentication Bypass via the uuid and code parameters of the social-login callback handler. The root cause is a lack of nonce validation, OAuth state verification, and per-visitor namespace isolation...