CVE-2026-12598 HIGH

CVE-2026-12598: LoginPress Pro <= 6.2.3 - Unauthenticated Authentication Bypass via Unverified OAuth Email in Spotify OAuth Callback

Vendor Loginpress

Product LoginPress Pro

Weakness CWE-287 · Improper authentication

Published July 9, 2026

Last update July 9, 2026

View on NVD All CVEs

CVSS base score

8.1/10

Attack vector Network

Attack complexity High

Privileges required None

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

The LoginPress Pro plugin for WordPress is vulnerable to authentication bypass in versions up to and including 6.2.3 via the Spotify Social Login addon. This is due to the loginpress_on_spotify_login() function trusting the unverified 'email' field returned by Spotify's /v1/me endpoint and using it directly with get_user_by('email', $profile['email']) to identify and log in an existing WordPress account, without confirming that the Spotify user actually owns the email address (Spotify documents that the profile email is unverified) and without requiring the user to prove ownership of the matching WordPress account. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including Administrators, by registering a Spotify account using the targeted user's email address and authenticating via the Spotify provider.

Explanation of Vulnerability in Simple Terms

02Summary

LoginPress Pro versions up to 6.2.3 contain an authentication bypass vulnerability. An attacker can gain unauthorized access to the plugin without valid credentials by exploiting a flaw in the authentication mechanism. This affects all installations of the affected versions. Update to a version newer than 6.2.3 to remediate.

What an attacker can do

03Attacker Capabilities

Bypass authentication and gain unauthorized access to LoginPress Pro without valid credentials.

Potential impact on your site

04Site Impact

Attackers can access LoginPress Pro functionality and potentially modify login settings, user accounts, or site configuration.

Conditions required to exploit

05Prerequisites

Network access to the site; no authentication or user interaction required.

Key dates

06Disclosure timeline

July 9, 2026 CVE published

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-12598 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/287.html AskarLabs — CWE-287 write-up Improper Authentication

Related vulnerabilities