CVE-2025-7444

LoginPress Pro <= 5.0.1 - Authentication Bypass via WordPress.com OAuth provider

Published Jul 18, 2025 CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Description

The LoginPress Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.0.1. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email and the user does not have an already-existing account for the service returning the token.

Analysis

Technical impact

LoginPress Pro plugin for WordPress up to version 5.0.1 has an authentication bypass that permits an unauthenticated attacker to log in as an existing user by submitting a WordPress.com OAuth token for that user's email. The flaw stems from insufficient verification of the user returned by the token, enabling attackers who know or can guess the target email to gain full site access, including administrator privileges, thereby compromising confidentiality, integrity, and availability.

Affected Systems

LoginPress Pro plugin for WordPress versions 5.0.1 and older.

Risk and Exploitability

The CVSS score of 9.8 classifies this vulnerability as critical, although its EPSS score of less than 1% indicates a low probability of exploitation at present. It is not listed in the CISA KEV catalog, so no public, confirmed exploits are known. The attack vector is inferred to be remote, requiring an attacker to supply a WordPress.com OAuth token for a valid email address; once the token is accepted, the attacker can assume the account’s privileges.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

LoginPress

LoginPress Pro

unaffected

Version	Status	Constraints
`0`	affected	≤ 5.0.1

No data.

Vendor	Product	Versions
Wordpress	Wordpress	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade LoginPress Pro to the latest version (5.0.2 or newer) as soon as it becomes available.
Temporarily disable WordPress.com OAuth or all social login options until the plugin is patched.
Monitor authentication logs for unexpected logins and consider implementing multi‑factor authentication to mitigate exposure.

Generated by OpenCVE AI on April 21, 2026 at 03:57 UTC.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-21859	The LoginPress Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.0.1. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email and the user does not have an already-existing account for the service returning the token.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.605% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://loginpress.pro/changelog/
https://www.wordfence.com/threat-intel/vulnerabilities/id/80fcb3af-0b27-4442-aca0-58626b68f0d9?source=cve

History

Jul 18, 2025 2:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jul 18, 2025 8:45 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The LoginPress Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.0.1. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email and the user does not have an already-existing account for the service returning the token.
Title		LoginPress Pro <= 5.0.1 - Authentication Bypass via WordPress.com OAuth provider
Weaknesses		CWE-288
References		https://loginpress.pro/changelog/ https://www.wordfence.com/threat-intel/vulnerabilities/id/80fcb3af-0b27-4442-aca0-58626b68f0d9?source=cve
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`