LoginPress Pro plugin for WordPress up to version 5.0.1 has an authentication bypass that permits an unauthenticated attacker to log in as an existing user by submitting a WordPress.com OAuth token for that user's email. The flaw stems from insufficient verification of the user returned by the token, enabling attackers who know or can guess the target email to gain full site access, including administrator privileges, thereby compromising confidentiality, integrity, and availability.

LoginPress Pro plugin for WordPress versions 5.0.1 and older.

The CVSS score of 9.8 classifies this vulnerability as critical, although its EPSS score of less than 1% indicates a low probability of exploitation at present. It is not listed in the CISA KEV catalog, so no public, confirmed exploits are known. The attack vector is inferred to be remote, requiring an attacker to supply a WordPress.com OAuth token for a valid email address; once the token is accepted, the attacker can assume the account’s privileges.