CVE-2026-12598: high-severity vulnerability in LoginPress Pro
LoginPress Pro <= 6.2.3 - Unauthenticated Authentication Bypass via Unverified OAuth Email in Spotify OAuth Callback
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.1epss 0.6%
The LoginPress Pro plugin for WordPress is vulnerable to authentication bypass in versions up to and including 6.2.3 via the Spotify Social Login addon. This is due to the loginpress_on_spotify_login() function trusting the unverified 'email' field returned by Spotify's /v1/me endpoint and using it directly with get_user_by('email', $profile['email']) to identify and log in an existing WordPress account, without confirming that the Spotify user actually owns the email address (Spotify documents that the profile email is unverified) and without requiring the user to prove ownership of the matching WordPress account. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including Administrators, by registering a Spotify account using the targeted user's email address and authenticating via the Spotify provider.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
LoginPress · LoginPress ProRelated CVEs — LoginPress Pro
In the same product, most dangerous first.
CVE-2025-7444CRITICALLoginPress Pro <= 5.0.1 - Authentication Bypass via WordPress.com OAuth providerEPSS 0.6%CVE-2026-12597HIGHLoginPress Pro <= 6.2.3 - Unauthenticated Authentication Bypass via Unverified OAuth Email via GitHub OAuth CallbackEPSS 0.6%CVE-2026-12595HIGHLoginPress Pro <= 6.2.3 - Unauthenticated Authentication Bypass via Unverified OAuth Email via Discord OAuth CallbackEPSS 0.6%CVE-2024-32677MEDIUMWordPress LoginPress Pro plugin < 3.0.0 - Unauth. License Activation/Deactivation vulnerabilityEPSS 0.5%CVE-2024-32676MEDIUMWordPress LoginPress Pro plugin < 3.0.0 - Captcha Bypass vulnerabilityEPSS 0.4%CVE-2026-49058CRITICALWordPress LoginPress Pro plugin <= 6.2.2 - Privilege Escalation vulnerabilityEPSS 0.3%