Technical impact
The LoginPress Pro plugin for WordPress contains a flaw in its Spotify Social Login addon that accepts the unverified "email" field returned by Spotify's /v1/me endpoint. The plugin uses this email directly with get_user_by('email', $profile['email']) to identify and log in an existing WordPress account, without confirming that the Spotify account actually owns the email address. Because the email can be fabricated by creating a Spotify account with any target e‑mail address, an unauthenticated attacker can impersonate any site user, including administrators, thereby achieving full account compromise. This vulnerability maps to CWE-287, Authentication Bypass.
Affected Systems
The vulnerability affects WordPress sites that use any release of LoginPress Pro up to and including 6.2.3, provided the Spotify Social Login addon is enabled. Sites that rely on this plugin for user authentication are at risk whenever the addon is active.
Risk and Exploitability
The CVSS score of 8.1 indicates high severity, and the EPSS score of <1% reflects a very low probability of current exploitation. The attack requires only the ability to initiate a login request to the WordPress site using the Spotify provider; no further privileges or server‑side access are necessary. Based on the description, the likely attack vector is a server‑side OAuth callback. The exploitation path does not require client‑side interaction. The vulnerability is not listed in the CISA KEV catalog.
