HivePress Authentication <= 1.1.4 — Unauthenticated Authentication Bypass via 'access_token' Parameter to Facebook Authenticator

Am I affected?

• Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under HivePress Authentication.
• No admin access? Run a passive check of your site. It reads public files only.
• No account is needed to exploit this. Treat any exposed site on an affected version as at risk.

What to do

1. Update to version 1.1.5, or a newer patched version
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
3. Watch HivePress Authentication to get an email when the next vulnerability is published.

Advisory

Source description from Wordfence Intelligence, credited to Mutantgun.

The HivePress Authentication plugin for WordPress is vulnerable to Authentication Bypass via the access_token parameter in all versions up to, and including, 1.1.4. This is due to the authenticate_user function's Facebook authenticator resolving third-party identity by forwarding the attacker-supplied access_token to the Facebook Graph API and trusting the returned email and ID verbatim, without performing any application ID or audience validation — specifically, no /debug_token verification and no comparison of the token's app_id against the configured hp_facebook_app_id. This makes it possible for unauthenticated attackers to authenticate as any existing WordPress user, including administrators, whose email address is associated with a Facebook account for which the attacker can obtain any valid access token. Important Note: To exploit the vulnerability, the attacker must obtain the victim's access token.

Exploits & references

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

• Advisorywordfence.com

Timeline

1. Sep 5, 2026

   CVE published

   Severity high, CVSS 7.5

2. Nov 13, 2026

   Record last updated