Loginpress Pro Vulnerabilities

The LoginPress Pro plugin for WordPress is vulnerable to Authentication Bypass via the GitHub OAuth callback in versions up to, and including, 6.2.3. The vulnerability exists in the loginpress_on_github_login() function, which blindly trusts the first element (profile[0]['email']) of the array returned by GitHub's /use...

CVSS:

8.1

Affected:

up to 6.2.3

Fixed in:

6.2.4

Disclosed:

Jul 9, 2026

CVE-2026-12597 on NVD →

The LoginPress Pro plugin for WordPress is vulnerable to Authentication Bypass via Unverified OAuth Email in all versions up to and including 6.2.3. The vulnerability exists in the loginpress_on_discord_login() Discord OAuth callback handler, which accepts the email field returned by Discord's /users/@me endpoint witho...

CVSS:

8.1

Affected:

up to 6.2.3

Fixed in:

6.2.4

Disclosed:

Jul 9, 2026

CVE-2026-12595 on NVD →

The LoginPress Pro plugin for WordPress is vulnerable to authentication bypass in versions up to and including 6.2.3 via the Spotify Social Login addon. This is due to the loginpress_on_spotify_login() function trusting the unverified 'email' field returned by Spotify's /v1/me endpoint and using it directly with get_us...

CVSS:

8.1

Affected:

up to 6.2.3

Fixed in:

6.2.4

Disclosed:

Jul 9, 2026

CVE-2026-12598 on NVD →

The LoginPress Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.2.2. This makes it possible for unauthenticated attackers to elevate their privileges.

CVSS:

9.8

Affected:

up to 6.2.2

Fixed in:

6.2.3

Disclosed:

Jun 8, 2026

CVE-2026-49058 on NVD →

The LoginPress Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.0.1. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such...

CVSS:

9.8

Affected:

up to 5.0.1

Fixed in:

5.0.2

Disclosed:

Jul 17, 2025

CVE-2025-7444 on NVD →

[en] Improper Restriction of Excessive Authentication Attempts vulnerability in LoginPress LoginPress Pro allows Removing Important Client Functionality.This issue affects LoginPress Pro: from n/a before 3.0.0.

Affected:

up to 3.0.0

Fixed in:

3.0.0

Disclosed:

Apr 25, 2024

CVE-2024-32676 on NVD →

[en] Missing Authorization vulnerability in LoginPress LoginPress Pro.This issue affects LoginPress Pro: from n/a before 3.0.0.

Affected:

up to 3.0.0

Fixed in:

3.0.0

Disclosed:

Apr 24, 2024

CVE-2024-32677 on NVD →

The LoginPress Pro plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in all versions up to, but not including, 3.0. This makes it possible for unauthenticated attacks to activate and deactivate licenses.

CVSS:

5.3

Affected:

up to 3.0

Fixed in:

3.0

Disclosed:

Apr 17, 2024

CVE-2024-32677 on NVD →

The LoginPress Pro plugin for WordPress is vulnerable to Captcha Bypass in versions up to, but not including, 3.0. This makes it possible for unauthenticated attackers to bypass the Captcha Verification.

CVSS:

5.3

Affected:

up to 3.0

Fixed in:

3.0

Disclosed:

Apr 17, 2024

CVE-2024-32676 on NVD →

Affected:

up to 5.0.2

Fixed in:

5.0.2

CVE-2025-7444 on NVD →