CVE-2025-7444: critical vulnerability in LoginPress Pro
LoginPress Pro <= 5.0.1 - Authentication Bypass via WordPress.com OAuth provider
Published · Updated
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.8epss 0.5%
exploitation probability
0.5%top 56% of all CVEs
observed exploitation
nono source reports it
The LoginPress Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.0.1. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email and the user does not have an already-existing account for the service returning the token.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
LoginPress · LoginPress ProRelated CVEs — LoginPress Pro
In the same product, most dangerous first.
CVE-2026-12597HIGHLoginPress Pro <= 6.2.3 - Unauthenticated Authentication Bypass via Unverified OAuth Email via GitHub OAuth CallbackEPSS 0.6%CVE-2026-12598HIGHLoginPress Pro <= 6.2.3 - Unauthenticated Authentication Bypass via Unverified OAuth Email in Spotify OAuth CallbackEPSS 0.6%CVE-2026-12595HIGHLoginPress Pro <= 6.2.3 - Unauthenticated Authentication Bypass via Unverified OAuth Email via Discord OAuth CallbackEPSS 0.6%CVE-2024-32677MEDIUMWordPress LoginPress Pro plugin < 3.0.0 - Unauth. License Activation/Deactivation vulnerabilityEPSS 0.5%CVE-2026-49058CRITICALWordPress LoginPress Pro plugin <= 6.2.2 - Privilege Escalation vulnerabilityEPSS 0.5%CVE-2024-32676MEDIUMWordPress LoginPress Pro plugin < 3.0.0 - Captcha Bypass vulnerabilityEPSS 0.4%