The LoginPress Pro plugin for WordPress contains an authentication bypass flaw that allows an unauthenticated attacker to log in as any existing local user, including administrators. The vulnerability resides in the GitHub OAuth callback handling, where the plugin unconditionally trusts the first e‑mail address returned by GitHub’s /user/emails endpoint as a binding identifier without verifying that the address is marked as verified. By adding an unverified e‑mail that matches a local account in a malicious GitHub profile and triggering the OAuth flow with a crafted code parameter, the plugin retrieves the user by e‑mail and establishes an authenticated session for the matched account.

LoginPress Pro for WordPress versions 6.2.3 and earlier are affected. If a WordPress site runs any of these releases, the plugin's GitHub OAuth integration is vulnerable to the bypass described above.

The flaw carries a CVSS score of 8.1, indicating high severity. The EPSS score is less than 1%, suggesting a low likelihood of active exploitation, yet the lack of email verification enables a straightforward remote attack via the OAuth callback. The vulnerability is not listed in the CISA KEV catalog, but it allows remote attackers to gain full access to any Wordpress user account without authentication.