LoginPress Pro <= 6.2.3 Unauthenticated Authentication Bypass via Unverified Spotify OAuth Email (CVE-2026-12598)

Vulnerability Overview Vulnerability Name: LoginPress Pro <= 6.2.3 - Unauthenticated Authentication Bypass via Unverified OAuth Email in Spotify OAuth Callback CVE ID: CVE-2026-12598 CVSS Score: 8.1 (High) Publication Date: July 9, 2026 Researcher: Nguyen Ngoc Duc (duc193) Affected Software Software Type: Plugin Software Slug: loginpress-pro Affected Versions: <= 6.2.3 Patched Versions: 6.2.4 Remediation Remediation Advice: Upgrade to version 6.2.4 or later patched versions. Vulnerability Description The LoginPress Pro plugin, in versions 6.2.3 and earlier, contains an authentication bypass vulnerability. This issue arises because the function trusts the unverified field returned by Spotify's endpoint. It uses to identify and log into existing WordPress accounts without confirming that the Spotify user actually owns that email address (Spotify documentation states that the email in the profile is unverified). This allows an unauthenticated attacker to register a Spotify account using the target user's email address, thereby logging in as an existing WordPress user (including administrators) via the Spotify provider. Reference Links loginpress.pro Other Vulnerabilities CVE-2026-12597: LoginPress Pro <= 6.2.3 - Unauthenticated Authentication Bypass via Unverified OAuth Email via GitHub OAuth Callback CVE-2026-12595: LoginPress Pro <= 6.2.3 - Unauthenticated Authentication Bypass via Unverified OAuth Email via Discord OAuth Callback CVE-2026-49058: LoginPress Pro <= 6.2.2 - Unauthenticated Privilege Escalation CVE-2025-7444: LoginPress Pro <= 5.0.1 - Authentication Bypass via WordPress.com OAuth provider CVE-2024-32676: LoginPress Pro < 3.0 - Captcha Bypass CVE-2024-32677: LoginPress Pro < 3.0 - Missing Authorization to License Status Update Summary This vulnerability allows an unauthenticated attacker to bypass authentication via an unverified OAuth email, enabling them to log in as an existing WordPress user (including administrators). It is recommended to upgrade to version 6.2.4 or later patched versions as soon as possible to mitigate this issue.

Goal Reached Thanks to every supporter — we hit 100%!

LoginPress Pro <= 6.2.3 Unauthenticated Authentication Bypass via Unverified Spotify OAuth Email (CVE-2026-12598)

More from this source