CVE-2026-18056: HivePress Authentication Bypass Vulnerability

CVE-2026-18056 Overview

CVE-2026-18056 is an authentication bypass vulnerability in the HivePress Authentication plugin for WordPress, affecting all versions up to and including 1.1.4. The flaw lives in the plugin's Facebook authenticator, which forwards an attacker-supplied access_token to the Facebook Graph API and trusts the returned email and ID without validating the token's audience. Because the plugin does not call /debug_token or compare the token's app_id against the configured hp_facebook_app_id, an attacker with any valid Facebook access token issued for the victim can authenticate as any existing WordPress user, including administrators. The vulnerability is classified as Improper Authentication [CWE-287].

Critical Impact
Unauthenticated attackers can impersonate any WordPress user whose email is tied to a Facebook account, provided they can obtain a valid access token for that account.

Affected Products

HivePress Authentication plugin for WordPress, versions ≤ 1.1.4
WordPress sites with the facebook value present in hp_user_auth_methods and hp_facebook_app_id configured
Sites relying on HivePress social login for administrator or privileged accounts

Discovery Timeline

2026-09-06 - CVE-2026-18056 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-18056

Vulnerability Analysis

The HivePress Authentication plugin implements Facebook social login through the authenticate_user function in class-authentication.php and the Facebook authenticator defined in class-facebook-authentication.php. When a client submits an access_token parameter, the plugin sends the token to the Facebook Graph API and reads back the email and id fields. The plugin then resolves the associated WordPress account and issues a session for that user.

The authenticator never validates that the presented token was minted for the site's own Facebook application. Facebook's own guidance requires calling the /debug_token endpoint and confirming that the returned app_id matches the relying party's application. Skipping that step means any token that Facebook considers valid, even one issued to an unrelated third-party app, satisfies the check.

Root Cause

The root cause is missing audience validation on OAuth-style bearer tokens. The Graph API happily returns profile data for any token it accepts, so trusting the response verbatim conflates authentication of the token with authentication of the user in the context of this application. The pre-patch code path also lacked a stored hp_facebook_app_secret, so app-scoped verification calls were not possible.

Attack Vector

An attacker first obtains a Facebook access token that resolves to the victim's account. This can occur through a malicious third-party Facebook application that the victim has authorized, token theft, or a phishing flow that harvests OAuth grants. The attacker then submits that token to the vulnerable WordPress endpoint. The plugin queries Graph API, receives the victim's email, and logs the attacker in as the matching WordPress user. If that email belongs to an administrator, the attacker inherits full site control.

php

// Security patch in includes/components/class-facebook-authentication.php
// Adds enforcement of an app secret so token audience can be verified
 public function __construct( $args = [] ) {

+   // Add admin notices.
+   add_filter( 'hivepress/v1/admin_notices', [ $this, 'add_admin_notices' ] );
+
    // Check Facebook status.
-   if ( ! in_array( 'facebook', (array) get_option( 'hp_user_auth_methods' ), true ) || ! get_option( 'hp_facebook_app_id' ) ) {
+   if ( ! in_array( 'facebook', (array) get_option( 'hp_user_auth_methods' ), true ) || ! get_option( 'hp_facebook_app_id' ) || ! get_option( 'hp_facebook_app_secret' ) ) {
        return;
    }

Source: GitHub Commit for Hivepress Authentication

Detection Methods for CVE-2026-18056

Indicators of Compromise

Successful WordPress logins for administrator or editor accounts immediately preceded by a request containing an access_token parameter to the HivePress authentication endpoint.
Session establishment for accounts that historically authenticate with local WordPress credentials rather than social login.
Graph API callbacks originating from the WordPress host but tied to authentication events for high-privilege users.

Detection Strategies

Inspect web server logs for POST or GET requests to the HivePress authentication controller carrying an access_token query or body parameter.
Correlate WordPress wp_login audit events with the source IP and user agent of the preceding access_token request to identify anomalous geographies or clients.
Alert on any successful authentication for an administrator account whose email is associated with a Facebook profile but where multi-factor authentication was not exercised.

Monitoring Recommendations

Enable WordPress authentication logging through a plugin such as WP Activity Log and forward events to a central SIEM for correlation.
Monitor outbound HTTPS traffic from the WordPress host to graph.facebook.com and flag calls that are not followed by a /debug_token verification request in patched deployments.
Track version inventory of the hivepress-authentication plugin across managed WordPress sites and alert on any host still running 1.1.4 or earlier.

How to Mitigate CVE-2026-18056

Immediate Actions Required

Update the HivePress Authentication plugin to the version released in changeset 3664231, which introduces the hp_facebook_app_secret requirement.
After patching, populate the new App Secret field in the plugin settings so the Facebook authenticator can verify token audience.
Force a password reset and terminate active sessions for all administrator accounts whose emails are associated with Facebook profiles.

Patch Information

The vendor fix is available in the GitHub commit f97d910 and shipped through the WordPress plugin repository. The patch adds an hp_facebook_app_secret option and refuses to initialize the Facebook authenticator unless the secret is configured, enabling proper app-scoped token verification. Review the WordPress plugin change set and the Wordfence Vulnerability Analysis Report for full details.

Workarounds

Remove facebook from the hp_user_auth_methods option to disable the vulnerable authenticator until the patch and App Secret can be applied.
Restrict access to the HivePress authentication endpoint at the web application firewall by blocking requests containing an access_token parameter.
Require multi-factor authentication for all WordPress administrator accounts so that possession of a Facebook token alone is insufficient to complete login.

bash

# Disable HivePress Facebook authentication via WP-CLI as a temporary workaround
wp option get hp_user_auth_methods --format=json
wp option update hp_user_auth_methods '["password"]' --format=json
wp plugin update hivepress-authentication