CVE-2026-12598
Received Received - Intake

Authentication Bypass in LoginPress Pro WordPress Plugin

Publication date: 2026-07-10

Last updated on: 2026-07-10

Assigner: Wordfence

Description
The LoginPress Pro plugin for WordPress is vulnerable to authentication bypass in versions up to and including 6.2.3 via the Spotify Social Login addon. This is due to the loginpress_on_spotify_login() function trusting the unverified 'email' field returned by Spotify's /v1/me endpoint and using it directly with get_user_by('email', $profile['email']) to identify and log in an existing WordPress account, without confirming that the Spotify user actually owns the email address (Spotify documents that the profile email is unverified) and without requiring the user to prove ownership of the matching WordPress account. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including Administrators, by registering a Spotify account using the targeted user's email address and authenticating via the Spotify provider.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-10
Last Modified
2026-07-10
Generated
2026-07-10
AI Q&A
2026-07-10
EPSS Evaluated
N/A
NVD
CVE-2026-12598
EUVD
EUVD-2026-42760

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wp_loginpress loginpress_pro to 6.2.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The LoginPress Pro plugin for WordPress, up to version 6.2.3, has an authentication bypass vulnerability via its Spotify Social Login addon. The vulnerability arises because the function loginpress_on_spotify_login() trusts the unverified 'email' field returned by Spotify's /v1/me endpoint. It uses this email directly to find and log in a WordPress user without verifying that the Spotify user actually owns that email address. Since Spotify's profile email is unverified, an attacker can create a Spotify account with someone else's email and log in as that WordPress user, including administrators, without needing to prove ownership.

Impact Analysis

This vulnerability allows unauthenticated attackers to log in as any existing WordPress user, including administrators, by exploiting the unverified email field from Spotify. This can lead to full account takeover, unauthorized access to sensitive information, modification or deletion of content, and potentially complete control over the affected WordPress site.

Mitigation Strategies

To mitigate this vulnerability, you should update the LoginPress Pro plugin to a version later than 6.2.3 where the authentication bypass issue via the Spotify Social Login addon is fixed.

Additionally, consider disabling the Spotify Social Login addon until a patch is applied to prevent unauthenticated attackers from exploiting the unverified email field.

Compliance Impact

The vulnerability allows unauthenticated attackers to bypass authentication and log in as any existing WordPress user, including administrators, by exploiting the unverified email field from Spotify's login data. This unauthorized access could lead to exposure or modification of sensitive personal data stored on the affected WordPress site.

Such unauthorized access and potential data breaches may negatively impact compliance with data protection regulations like GDPR and HIPAA, which require strict controls on user authentication and protection of personal data.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12598. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart