CVE-2026-12595
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
The LoginPress Pro plugin for WordPress up to version 6.2.3 contains an authentication bypass vulnerability via unverified OAuth email. The loginpress_on_discord_login() function accepts the email field from Discord without checking the verified flag, allowing administrator account takeover.
Risk Assessment
An unauthenticated attacker can take over any WordPress account, including admin accounts, by registering a Discord account with an unverified email matching the target user and completing the standard Discord OAuth flow.
Recommendation
Immediately update the LoginPress Pro plugin to the latest available version that fixes this vulnerability and implement additional email verification in the OAuth login process.
Other vulnerabilities in LoginPress Pro
See all- CVE-2026-49058Critical
LoginPress Pro versions up to 6.2.2 contain a vulnerability allowing unauthenticated privilege escalation.
- CVE-2026-12598High
The LoginPress Pro plugin for WordPress up to version 6.2.3 has an authentication bypass vulnerability in the Spotify Social Login addon. The loginpress_on_spotify_login() function trusts the unverified 'email' field from Spotify's API and uses it to log into an existing WordPress account without verifying email ownership.
- CVE-2026-12597High
The LoginPress Pro plugin for WordPress up to version 6.2.3 has an authentication bypass vulnerability via GitHub OAuth. The loginpress_on_github_login() function blindly trusts the first email from GitHub's API response without verifying it, allowing an attacker to log in as any WordPress user, including administrators.
Original NVD description (English source)
The LoginPress Pro plugin for WordPress is vulnerable to Authentication Bypass via Unverified OAuth Email in all versions up to and including 6.2.3. The vulnerability exists in the loginpress_on_discord_login() Discord OAuth callback handler, which accepts the email field returned by Discord's /users/@me endpoint without ever checking that the profile's verified flag is true, then directly maps that email to a local WordPress account via get_user_by('email', $profile['email']) and issues an authenticated session cookie via wp_set_auth_cookie(). This makes it possible for unauthenticated attackers to take over any existing WordPress account — including administrator accounts — by registering a Discord account configured with an unverified email address that matches the target user's registered WordPress email and completing the standard Discord OAuth flow.