CVE-2026-49058
CriticalCVSS 9.8Summary
LoginPress Pro versions up to 6.2.2 contain a vulnerability allowing unauthenticated privilege escalation.
Risk Assessment
An attacker could exploit this vulnerability to gain elevated privileges in the system, potentially leading to serious security breaches.
Recommendation
It is recommended to update LoginPress Pro to the latest version to mitigate this vulnerability.
Other vulnerabilities in LoginPress Pro
See all- CVE-2026-12598High
The LoginPress Pro plugin for WordPress up to version 6.2.3 has an authentication bypass vulnerability in the Spotify Social Login addon. The loginpress_on_spotify_login() function trusts the unverified 'email' field from Spotify's API and uses it to log into an existing WordPress account without verifying email ownership.
- CVE-2026-12597High
The LoginPress Pro plugin for WordPress up to version 6.2.3 has an authentication bypass vulnerability via GitHub OAuth. The loginpress_on_github_login() function blindly trusts the first email from GitHub's API response without verifying it, allowing an attacker to log in as any WordPress user, including administrators.
- CVE-2026-12595High
The LoginPress Pro plugin for WordPress up to version 6.2.3 contains an authentication bypass vulnerability via unverified OAuth email. The loginpress_on_discord_login() function accepts the email field from Discord without checking the verified flag, allowing administrator account takeover.
Original NVD description (English source)
Unauthenticated Privilege Escalation in LoginPress Pro <= 6.2.2 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS