LoginPress Pro Plugin up to 6.2.3 GitHub OAuth Callback loginpress_on_github_login email improper authentication

Summaryinfo

A vulnerability was found in LoginPress Pro Plugin up to 6.2.3. It has been declared as critical. Affected is the function loginpress_on_github_login of the component GitHub OAuth Callback Handler. The manipulation of the argument email results in improper authentication. This vulnerability is identified as CVE-2026-12597. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in LoginPress Pro Plugin up to 6.2.3. It has been classified as critical. Affected is the function loginpress_on_github_login of the component GitHub OAuth Callback Handler. The manipulation of the argument email with an unknown input leads to a improper authentication vulnerability. CWE is classifying the issue as CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

The LoginPress Pro plugin for WordPress is vulnerable to Authentication Bypass via the GitHub OAuth callback in versions up to, and including, 6.2.3. The vulnerability exists in the loginpress_on_github_login() function, which blindly trusts the first element (profile[0]['email']) of the array returned by GitHub's /user/emails endpoint as an account-binding identifier without verifying that the email carries a verified === true status. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including administrators, by adding an unverified email address matching a local account to their GitHub profile and triggering the OAuth callback via a crafted code parameter — causing the plugin to call get_user_by('email', ...) and establish an authenticated session for the matched account. Practical exploitation is conditional on GitHub returning the attacker-added unverified email at index 0 of the /user/emails response, as GitHub typically prioritizes the primary verified address first; nonetheless, the absence of any email verification check in the plugin constitutes a fundamental authentication bypass flaw.

The advisory is shared for download at wordfence.com. This vulnerability is traded as CVE-2026-12597 since 06/18/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 07/10/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-42758). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• LoginPress

Name

• Pro Plugin

Version

• 6.2.0
• 6.2.1
• 6.2.2
• 6.2.3

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion