Description

The HivePress Authentication plugin for WordPress is vulnerable to Authentication Bypass via the access_token parameter in all versions up to, and including, 1.1.4. This is due to the authenticate_user function's Facebook authenticator resolving third-party identity by forwarding the attacker-supplied access_token to the Facebook Graph API and trusting the returned email and ID verbatim, without performing any application ID or audience validation — specifically, no /debug_token verification and no comparison of the token's app_id against the configured hp_facebook_app_id. This makes it possible for unauthenticated attackers to authenticate as any existing WordPress user, including administrators, whose email address is associated with a Facebook account for which the attacker can obtain any valid access token. Important Note: To exploit the vulnerability, the attacker must obtain the victim's access token.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-06T03:17:16.467Z",
  "pubdate": "2026-09-06T03:17:16.467Z",
  "executiveSummary": "The HivePress plugin for WordPress is susceptible to an authentication bypass vulnerability within its Facebook integration mechanism, affecting all versions up to and including 1.1.4.\nThe vulnerability arises from improper validation of OAuth tokens received from the Facebook Graph API. By failing to verify that the provided access token was specifically issued for the site's configured Facebook application ID, the system incorrectly treats user information returned by the API as authoritative.\nAn unauthenticated attacker can exploit this flaw to impersonate any legitimate user, including administrative accounts, provided the attacker can obtain a valid Facebook access token associated with the target's email address.\nThis vulnerability constitutes a critical security risk, as it allows for full account takeover without requiring knowledge of the victim's WordPress credentials. Successful exploitation grants the attacker the same privileges as the compromised account. The primary requirement for exploitation is the acquisition of a valid Facebook access_token belonging to the targeted WordPress user.",
  "technicalDetails": "The vulnerability resides within the authenticate_user function of the HivePress plugin, specifically within the Facebook authentication handler. The component performs an insecure verification process when processing third-party authentication requests.\nThe root cause is a failure to perform adequate token validation via the Facebook /debug_token endpoint. Instead of verifying the audience and metadata of the access_token, the plugin forwards the attacker-supplied parameter directly to the Facebook Graph API. The system then implicitly trusts the user data returned by the API—namely the email address and user ID—without cross-referencing this data against the plugin's configured hp_facebook_app_id.\nThe attack flow proceeds as follows: First, the attacker identifies a target WordPress user whose email address is also registered with a Facebook account. Second, the attacker obtains a valid Facebook access_token that they control (or have otherwise acquired). Third, the attacker initiates a login request to the vulnerable HivePress endpoint, injecting the obtained access_token into the request.\nThe server-side code processes this token by querying the Facebook Graph API to retrieve identity information. Because the plugin does not enforce validation of the app_id associated with the token, the API returns the legitimate user's profile details associated with the email address linked to the token.\nThe HivePress authentication logic then matches the returned email address against the WordPress user database. Upon finding a match, the plugin generates an authentication session for the victim's account, bypassing all standard password checks and Multi-Factor Authentication (MFA) protocols.\nThis vulnerability is classified as an authentication bypass that operates over the network. It does not require any prior privileges, as the goal is to establish an authenticated session for an existing account. The impact is total account compromise, granting the attacker full access to the victim's account data and, in the case of administrative users, full control over the WordPress installation.\nThe lack of /debug_token verification prevents the plugin from detecting if the token was intended for a different application, effectively allowing cross-application token usage to perform unauthorized logins."
}