CVE-2026-12598
Deferred Deferred - Pending Action

Authentication Bypass in LoginPress Pro WordPress Plugin

Publication date: 2026-07-10

Last updated on: 2026-07-10

Assigner: Wordfence

Description
The LoginPress Pro plugin for WordPress is vulnerable to authentication bypass in versions up to and including 6.2.3 via the Spotify Social Login addon. This is due to the loginpress_on_spotify_login() function trusting the unverified 'email' field returned by Spotify's /v1/me endpoint and using it directly with get_user_by('email', $profile['email']) to identify and log in an existing WordPress account, without confirming that the Spotify user actually owns the email address (Spotify documents that the profile email is unverified) and without requiring the user to prove ownership of the matching WordPress account. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including Administrators, by registering a Spotify account using the targeted user's email address and authenticating via the Spotify provider.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-10
Last Modified
2026-07-10
Generated
2026-07-30
AI Q&A
2026-07-10
EPSS Evaluated
2026-07-28
NVD
CVE-2026-12598
EUVD
EUVD-2026-42760

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wp_loginpress loginpress_pro to 6.2.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The LoginPress Pro plugin for WordPress, up to version 6.2.3, has an authentication bypass vulnerability via its Spotify Social Login addon. The vulnerability arises because the function loginpress_on_spotify_login() trusts the unverified 'email' field returned by Spotify's /v1/me endpoint. It uses this email directly to find and log in a WordPress user without verifying that the Spotify user actually owns that email address. Since Spotify's profile email is unverified, an attacker can create a Spotify account with someone else's email and log in as that WordPress user, including administrators, without needing to prove ownership.

Detection Guidance

This vulnerability involves the LoginPress Pro plugin for WordPress versions up to 6.2.3 using the Spotify Social Login addon. Detection involves identifying if the vulnerable plugin and addon versions are installed and active on your WordPress site.

You can check the installed plugin version via WordPress admin dashboard or by running commands on the server hosting WordPress.

  • Check the LoginPress Pro plugin version by inspecting the plugin directory: `grep 'Version' wp-content/plugins/loginpress-pro/loginpress-pro.php`
  • Look for the presence of the Spotify Social Login addon within the LoginPress plugin folders or settings.
  • Search your WordPress user login logs or authentication logs for suspicious logins via Spotify social login, especially logins that do not correspond to verified email ownership.

Since the vulnerability allows authentication bypass by exploiting unverified Spotify email fields, monitoring unusual login patterns or unexpected administrator logins via Spotify social login can help detect exploitation attempts.

Impact Analysis

This vulnerability allows unauthenticated attackers to log in as any existing WordPress user, including administrators, by exploiting the unverified email field from Spotify. This can lead to full account takeover, unauthorized access to sensitive information, modification or deletion of content, and potentially complete control over the affected WordPress site.

Compliance Impact

The vulnerability allows unauthenticated attackers to bypass authentication and log in as any existing WordPress user, including administrators, by exploiting the unverified email field from Spotify's login data. This unauthorized access could lead to exposure or modification of sensitive personal data stored on the affected WordPress site.

Such unauthorized access and potential data breaches may negatively impact compliance with data protection regulations like GDPR and HIPAA, which require strict controls on user authentication and protection of personal data.

Mitigation Strategies

To mitigate this vulnerability, you should update the LoginPress Pro plugin to a version later than 6.2.3 where the authentication bypass issue via the Spotify Social Login addon is fixed.

Additionally, consider disabling the Spotify Social Login addon until a patch is applied to prevent unauthenticated attackers from exploiting the unverified email field.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12598. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart