CVE-2026-18056

The HivePress Authentication plugin for WordPress (all versions through 1.1.4) contains an unauthenticated authentication bypass (CWE-287) in its Facebook login handler. The authenticate_user function forwards an attacker-supplied access_token to the Facebook Graph API and trusts the returned email and ID verbatim, without verifying the token was issued for the site's configured Facebook app — no /debug_token call and no comparison of the token's app_id against the configured hp_facebook_app_id. To exploit it, an attacker must first obtain a valid access token belonging to the Facebook account whose email matches the target WordPress user's email; with such a token they can log in as any existing user, including administrators, and take over the site. Any WordPress site running the plugin with Facebook authentication enabled is affected, but the required token-acquisition step raises the attack complexity, consistent with the high-complexity CVSS 3.1 score of 7.5. There is no known public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS estimates only a 0.3% probability of exploitation in the next 30 days.

What to do: Update HivePress Authentication to a release newer than 1.1.4 as soon as a patched version is available; until then, disable the Facebook login method or deactivate the plugin. Because exploitation requires first obtaining a valid access token tied to a user's Facebook account, be alert to token-phishing, and review admin accounts and active sessions for unexpected logins.