CVE-2026-12598
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
The LoginPress Pro plugin for WordPress up to version 6.2.3 has an authentication bypass vulnerability in the Spotify Social Login addon. The loginpress_on_spotify_login() function trusts the unverified 'email' field from Spotify's API and uses it to log into an existing WordPress account without verifying email ownership.
Risk Assessment
An unauthenticated attacker can log in as any WordPress user, including administrators, by registering a Spotify account with the victim's email and authenticating via Spotify. This leads to full site compromise.
Recommendation
Immediately update LoginPress Pro to the latest patched version. Until then, disable the Spotify Social Login addon.
Other vulnerabilities in LoginPress Pro
See all- CVE-2026-49058Critical
LoginPress Pro versions up to 6.2.2 contain a vulnerability allowing unauthenticated privilege escalation.
- CVE-2026-12597High
The LoginPress Pro plugin for WordPress up to version 6.2.3 has an authentication bypass vulnerability via GitHub OAuth. The loginpress_on_github_login() function blindly trusts the first email from GitHub's API response without verifying it, allowing an attacker to log in as any WordPress user, including administrators.
- CVE-2026-12595High
The LoginPress Pro plugin for WordPress up to version 6.2.3 contains an authentication bypass vulnerability via unverified OAuth email. The loginpress_on_discord_login() function accepts the email field from Discord without checking the verified flag, allowing administrator account takeover.
Original NVD description (English source)
The LoginPress Pro plugin for WordPress is vulnerable to authentication bypass in versions up to and including 6.2.3 via the Spotify Social Login addon. This is due to the loginpress_on_spotify_login() function trusting the unverified 'email' field returned by Spotify's /v1/me endpoint and using it directly with get_user_by('email', $profile['email']) to identify and log in an existing WordPress account, without confirming that the Spotify user actually owns the email address (Spotify documents that the profile email is unverified) and without requiring the user to prove ownership of the matching WordPress account. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including Administrators, by registering a Spotify account using the targeted user's email address and authenticating via the Spotify provider.