CVE-2026-12597 LoginPress CVE debrief

Who should care

WordPress users with LoginPress Pro plugin installed should verify their version and update if necessary. Security teams monitoring WordPress vulnerabilities should prioritize this high-severity issue. Operators of affected systems should review the vulnerability details and plan for remediation. Vulnerability management teams should assess the potential impact and assign an owner for follow-up.

Technical summary

The LoginPress Pro plugin for WordPress is vulnerable to authentication bypass via the GitHub OAuth callback in versions up to, and including, 6.2.3. The vulnerability exists in the loginpress_on_github_login() function, which trusts the first element (profile[0]['email']) of the array returned by GitHub's /user/emails endpoint without verifying the email's verified status. This allows unauthenticated attackers to log in as any existing WordPress user by adding an unverified email address matching a local account to their GitHub profile and triggering the OAuth callback.

Defensive priority

High priority due to authentication bypass and potential for exploitation

Recommended defensive actions

• Update LoginPress Pro to a version beyond 6.2.3
• Monitor GitHub OAuth callback for suspicious activity
• Verify email verification status for GitHub OAuth users
• Implement additional authentication measures for WordPress users
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. Limited information is available on exploitation or affected scope. Defenders should verify the GitHub OAuth callback implementation in LoginPress Pro plugin versions up to 6.2.3 and review email verification status for GitHub OAuth users. The plugin's authentication bypass vulnerability allows unauthenticated attackers to log in as any existing WordPress user by adding an unverified email address matching a local account to their GitHub profile and triggering the OAuth callback. Evidence limits suggest focusing on official advisories and CVE records for further details.

Official resources