LoginPress Pro vulnerabilities
4 known CVE vulnerabilities in LoginPress Pro, translated and rated.
- CVE-2026-49058Critical
LoginPress Pro versions up to 6.2.2 contain a vulnerability allowing unauthenticated privilege escalation.
- CVE-2026-12598High
The LoginPress Pro plugin for WordPress up to version 6.2.3 has an authentication bypass vulnerability in the Spotify Social Login addon. The loginpress_on_spotify_login() function trusts the unverified 'email' field from Spotify's API and uses it to log into an existing WordPress account without verifying email ownership.
- CVE-2026-12597High
The LoginPress Pro plugin for WordPress up to version 6.2.3 has an authentication bypass vulnerability via GitHub OAuth. The loginpress_on_github_login() function blindly trusts the first email from GitHub's API response without verifying it, allowing an attacker to log in as any WordPress user, including administrators.
- CVE-2026-12595High
The LoginPress Pro plugin for WordPress up to version 6.2.3 contains an authentication bypass vulnerability via unverified OAuth email. The loginpress_on_discord_login() function accepts the email field from Discord without checking the verified flag, allowing administrator account takeover.