Description
The LoginPress Pro plugin for WordPress is vulnerable to Authentication Bypass via Unverified OAuth Email in all versions up to and including 6.2.3. The vulnerability exists in the loginpress_on_discord_login() Discord OAuth callback handler, which accepts the email field returned by Discord's /users/@me endpoint without ever checking that the profile's verified flag is true, then directly maps that email to a local WordPress account via get_user_by('email', $profile['email']) and issues an authenticated session cookie via wp_set_auth_cookie(). This makes it possible for unauthenticated attackers to take over any existing WordPress account — including administrator accounts — by registering a Discord account configured with an unverified email address that matches the target user's registered WordPress email and completing the standard Discord OAuth flow.
Published: 2026-07-09
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The LoginPress Pro plugin for WordPress is vulnerable because it accepts an email address returned from Discord’s OAuth callback without checking that the Discord profile is marked as verified. Once that email is received, the plugin maps it directly to a WordPress user account and issues an authenticated session cookie, allowing anyone who can supply that e‑mail to log in as that user. The result is a full compromise of the target account, including administrative privileges, and a classic authentication bypass weakness described by CWE‑287.

Affected Systems

All installations of LoginPress Pro version 6.2.3 and earlier are affected. The flaw is confined to the Discord OAuth integration; sites that have disabled Discord login or do not use LoginPress Pro are not vulnerable.

Risk and Exploitability

The CVSS score of 8.1 signals high severity. The EPSS score is less than 1 %, indicating a low but non‑zero chance of exploitation. The likely attack vector is inferred from the description: an attacker can register a Discord account with an unverified e‑mail that matches a target WordPress user’s e‑mail and then complete the standard OAuth flow. This requires only internet access to Discord and the WordPress site, no special privileges, and an attacker can obtain unrestricted access to any account whose e‑mail is used in an unverified Discord profile. The vulnerability is not listed in the CISA KEV catalog but its potential impact warrants immediate attention.

Generated by OpenCVE AI on July 31, 2026 at 13:16 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update LoginPress Pro to the latest version that includes the authentication‑bypass fix.
  • If an update is not yet available, temporarily disable the Discord OAuth login feature or disable the LoginPress Pro plugin on the site until it is patched.
  • Ensure that the OAuth callback code verifies the email_verified flag from Discord before mapping the address to a WordPress account or consider disabling Discord login for administrator accounts until a fix is released.

Generated by OpenCVE AI on July 31, 2026 at 13:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 10 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 10 Jul 2026 00:45:00 +0000

Type Values Removed Values Added
First Time appeared Loginpress
Loginpress loginpress Pro
Wordpress
Wordpress wordpress
Vendors & Products Loginpress
Loginpress loginpress Pro
Wordpress
Wordpress wordpress

Thu, 09 Jul 2026 23:45:00 +0000

Type Values Removed Values Added
Description The LoginPress Pro plugin for WordPress is vulnerable to Authentication Bypass via Unverified OAuth Email in all versions up to and including 6.2.3. The vulnerability exists in the loginpress_on_discord_login() Discord OAuth callback handler, which accepts the email field returned by Discord's /users/@me endpoint without ever checking that the profile's verified flag is true, then directly maps that email to a local WordPress account via get_user_by('email', $profile['email']) and issues an authenticated session cookie via wp_set_auth_cookie(). This makes it possible for unauthenticated attackers to take over any existing WordPress account — including administrator accounts — by registering a Discord account configured with an unverified email address that matches the target user's registered WordPress email and completing the standard Discord OAuth flow.
Title LoginPress Pro <= 6.2.3 - Unauthenticated Authentication Bypass via Unverified OAuth Email via Discord OAuth Callback
Weaknesses CWE-287
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Loginpress Loginpress Pro
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-07-10T14:13:16.007Z

Reserved: 2026-06-18T10:15:01.785Z

Link: CVE-2026-12595

cve-icon Vulnrichment

Updated: 2026-07-10T14:13:10.529Z

cve-icon NVD

Status : Deferred

Published: 2026-07-10T00:16:32.120

Modified: 2026-07-10T15:43:30.330

Link: CVE-2026-12595

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T13:30:17Z

Weaknesses