CVE-2026-12597
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
The LoginPress Pro plugin for WordPress up to version 6.2.3 has an authentication bypass vulnerability via GitHub OAuth. The loginpress_on_github_login() function blindly trusts the first email from GitHub's API response without verifying it, allowing an attacker to log in as any WordPress user, including administrators.
Risk Assessment
An attacker can hijack an administrator account by adding an unverified email to their GitHub profile and triggering the OAuth callback, leading to full site compromise.
Recommendation
Immediately update the LoginPress Pro plugin to the latest version that includes a fix to verify email status before authentication.
Other vulnerabilities in LoginPress Pro
See all- CVE-2026-49058Critical
LoginPress Pro versions up to 6.2.2 contain a vulnerability allowing unauthenticated privilege escalation.
- CVE-2026-12598High
The LoginPress Pro plugin for WordPress up to version 6.2.3 has an authentication bypass vulnerability in the Spotify Social Login addon. The loginpress_on_spotify_login() function trusts the unverified 'email' field from Spotify's API and uses it to log into an existing WordPress account without verifying email ownership.
- CVE-2026-12595High
The LoginPress Pro plugin for WordPress up to version 6.2.3 contains an authentication bypass vulnerability via unverified OAuth email. The loginpress_on_discord_login() function accepts the email field from Discord without checking the verified flag, allowing administrator account takeover.
Original NVD description (English source)
The LoginPress Pro plugin for WordPress is vulnerable to Authentication Bypass via the GitHub OAuth callback in versions up to, and including, 6.2.3. The vulnerability exists in the loginpress_on_github_login() function, which blindly trusts the first element (profile[0]['email']) of the array returned by GitHub's /user/emails endpoint as an account-binding identifier without verifying that the email carries a verified === true status. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including administrators, by adding an unverified email address matching a local account to their GitHub profile and triggering the OAuth callback via a crafted code parameter — causing the plugin to call get_user_by('email', ...) and establish an authenticated session for the matched account. Practical exploitation is conditional on GitHub returning the attacker-added unverified email at index 0 of the /user/emails response, as GitHub typically prioritizes the primary verified address first; nonetheless, the absence of any email verification check in the plugin constitutes a fundamental authentication bypass flaw.