LoginPress Pro CVE-2026-12595: Discord OAuth Account Takeover Vulnerability

Technical summary

The vulnerability resides in the loginpress_on_discord_login() function, which processes Discord's OAuth callback. The function extracts the email field from Discord's /users/@me endpoint response and directly uses it to look up a WordPress user via get_user_by('email', $profile['email']), then issues an authenticated session cookie without validating the verified flag in Discord's profile object. The absence of a verified email check creates a trust boundary violation: an attacker-controlled Discord account with an unverified email can be mapped to any existing WordPress user account whose email matches. Affected versions include all 6.x releases through 6.2.3.

Business impact

Account takeover of WordPress user accounts is a business-critical risk. Compromised administrator accounts grant full control over the WordPress site, enabling data exfiltration, malware installation, website defacement, and lateral movement into connected systems. For multi-user WordPress deployments (blogs, news sites, SaaS platforms), this vulnerability threatens all users equally. Even compromised contributor or editor accounts can publish malicious content. Remediation requires either immediate disabling of Discord login or upgrading to a patched version.

Affected systems

LoginPress Pro versions up to and including 6.2.3 are vulnerable. WordPress installations using LoginPress Pro with Discord OAuth authentication enabled are directly at risk. The vulnerability affects all user roles, with administrator accounts representing the highest-value targets. No version information on patched releases is provided in the advisory; verify against the vendor's official security announcements or release notes.

Exploitability

Exploitability is moderate-to-high in practice. While the CVSS score reflects AC:H (high attack complexity) due to the need for an attacker to register a Discord account and know the target's email, the barrier is low in real-world scenarios: email addresses are often public or discoverable, and Discord registration is free and instant. No user interaction is required—the attacker simply completes Discord's OAuth flow. The vulnerability is not in active KEV (Known Exploited Vulnerabilities) tracking, but the simplicity of the attack makes it attractive to threat actors once publicly disclosed.

Remediation

Immediate action: disable Discord OAuth authentication in LoginPress Pro settings if it is not essential to your WordPress deployment. Contact the LoginPress team for patched release information and timelines. Apply patches as soon as they become available. For enhanced security, consider implementing additional authentication verification layers (e.g., email confirmation on first login) or transitioning to an alternative authentication provider with stricter OAuth verification practices. Verify that your WordPress user base has not been compromised by reviewing login logs for unexpected Discord OAuth activity.

Patch guidance

Consult the official LoginPress plugin repository or vendor advisory for the specific patch version that addresses this vulnerability. No patch version number is disclosed in the CVE record. Update LoginPress Pro immediately upon availability of a patched release. Test the update in a staging environment first to ensure compatibility with your WordPress version and other plugins. After patching, review recent authentication logs and consider forcing a password reset for administrator accounts as a precautionary measure.

Detection guidance

Monitor WordPress authentication logs for successful logins originating from Discord OAuth that precede suspicious account activity or configuration changes. Check for unrecognized Discord-authenticated sessions in user management dashboards. Audit user accounts for recent login patterns, particularly administrator accounts, and cross-reference with Discord account registrations you do not recognize. Web application firewalls and WordPress security plugins can log OAuth callbacks; examine these logs for patterns consistent with account enumeration or takeover attempts. Enable two-factor authentication for all administrative accounts to add a secondary barrier against compromised credentials.

Why prioritize this

This vulnerability scores 8.1 (HIGH) under CVSS 3.1 with a vector reflecting high integrity and confidentiality impact. It permits unauthenticated account takeover of administrator accounts without user interaction or special knowledge beyond the target's email. The attack surface is broad (any WordPress site running vulnerable LoginPress Pro with Discord OAuth enabled) and exploitation is straightforward. While not yet in KEV tracking, the severity and simplicity warrant immediate prioritization for any affected deployment. Organizations relying on Discord authentication for access control should treat this as critical.

Risk score, explained

The CVSS 3.1 score of 8.1 reflects: (1) Network attack vector—no local access required; (2) High attack complexity—the attacker must register a Discord account and know/guess the target email, but both are low-friction steps; (3) No privileges required; (4) No user interaction required once the OAuth flow is initiated; (5) Scope unchanged; (6) High confidentiality, integrity, and availability impact—full account control grants unrestricted access to the WordPress site and its data. The score is calibrated to the severity of account takeover but acknowledges that exploitation requires some minimal reconnaissance or email enumeration.

Frequently asked questions