The LoginPress Pro plugin for WordPress is vulnerable because it accepts an email address returned from Discord’s OAuth callback without verifying that the Discord profile is marked as verified. The plugin then maps that email directly to a WordPress user account and issues an authenticated session cookie, allowing a malicious actor to log in as any account whose email address is also used on an unverified Discord account. The result is a complete compromise of the targeted WordPress account, including administrator or other privileged roles. This flaw corresponds to CWE‑287, a classic authentication bypass weakness.

All installations of LoginPress Pro up to and including version 6.2.3 are affected. Vendors should examine any WordPress sites that have deployed this plugin and verify the installed version. The vulnerability is specific to the Discord OAuth integration provided by the plugin; sites that have disabled Discord logins are not vulnerable.

The CVSS score of 8.1 indicates a high severity risk. The EPSS score is less than 1 %, indicating a low but non‑zero likelihood of exploitation. The flaw is straightforward to exploit: an attacker can register any Discord account, set an unverified email that matches a target WordPress user, and then run the normal OAuth flow. The attack requires only internet access to Discord and the WordPress site, and no special user privileges. Because the authentication bypass provides unrestricted access, the impact is very high for confidentiality, integrity, and availability. The flaw is not currently listed in the CISA KEV catalog, but its potential for wide exploitation warrants immediate attention.