CVE-2026-12597: LoginPress Pro WordPress Authentication Bypass via GitHub OAuth

Technical summary

The loginpress_on_github_login() function in LoginPress Pro versions up to 6.2.3 fails to validate the verification status of email addresses returned by GitHub's /user/emails endpoint. The function blindly trusts profile[0]['email']—the first element in the array—and calls get_user_by('email', ...) to establish a session without confirming that the email carries a verified === true attribute. This creates an authentication bypass: an unauthenticated attacker can add an unverified email matching an existing WordPress user to their GitHub account, initiate the OAuth flow with a crafted code parameter, and receive an authenticated session for that user. The vulnerability is classified under CWE-287 (Improper Authentication).

Business impact

This vulnerability directly compromises access control on WordPress sites using LoginPress Pro. An attacker can gain administrative access to affected WordPress instances, enabling full site takeover, data exfiltration, malware injection, defacement, or lateral movement into connected systems. The risk is amplified for multi-user sites, agencies, and enterprises where compromised admin accounts cascade into broader operational or data security incidents. Organizations relying on OAuth for simplified authentication without additional access controls face immediate and high-severity impact.

Affected systems

LoginPress Pro for WordPress is affected in versions up to and including 6.2.3. The vulnerability applies to any WordPress installation running a vulnerable version of the plugin with GitHub OAuth enabled. Sites using alternative authentication methods (standard WordPress login, other OAuth providers, or LoginPress Pro versions after 6.2.3 if patched) are not affected. Verify your current plugin version in the WordPress admin panel under Plugins.

Exploitability

Exploitation requires the attacker to have a GitHub account and the ability to add an unverified email to it, then trigger the OAuth callback on the target WordPress site. The practical likelihood depends on GitHub's email ordering behavior: GitHub typically prioritizes verified addresses first, so an attacker-controlled unverified email would need to appear at index 0 of the response for reliable exploitation. Despite this ordering dependency, the complete absence of email verification checks in the plugin constitutes a fundamental authentication bypass flaw that could be exploited under certain conditions. No public exploit code has been reported, and the vulnerability does not yet appear on CISA's Known Exploited Vulnerabilities (KEV) catalog.

Remediation

Update LoginPress Pro to a patched version beyond 6.2.3 as soon as the vendor releases it. Verify the fix includes proper validation of the verified field from GitHub's email response before using any email address for account binding. In the interim, disable GitHub OAuth in LoginPress Pro settings if it is not essential for your site's workflow, or implement network-level restrictions to limit who can initiate the OAuth flow (e.g., by IP allowlist or requiring pre-authentication before OAuth is available).

Patch guidance

Contact the LoginPress Pro vendor or check the plugin's official documentation and WordPress plugin repository for patched versions beyond 6.2.3. When a patch is available, test it in a staging environment to confirm GitHub OAuth functionality and user account mapping work as intended before deploying to production. Document the patch version applied and the date of update for compliance and audit purposes.

Detection guidance

Monitor for OAuth callback requests with unusual code parameters or spike in failed/successful GitHub login attempts. Check WordPress user authentication logs for accounts logged in via GitHub OAuth that do not correspond to known legitimate users or have unusual IP origins. Review GitHub accounts for unverified email addresses matching your WordPress user roster, particularly admin accounts. If available, enable debug logging in LoginPress Pro to capture email values being passed to get_user_by() and cross-reference them with verified email checks.

Why prioritize this

With a CVSS score of 8.1 (HIGH) and the ability to grant attackers administrative access to WordPress sites, this vulnerability warrants urgent remediation. The attack surface is broad (any site with LoginPress Pro and GitHub OAuth enabled), the impact is severe (full site compromise), and the barrier to exploitation, while not trivial, is low enough that determined attackers may attempt it. Organizations should prioritize patching before continuing to expose administrative accounts via this mechanism.

Risk score, explained

The CVSS 3.1 score of 8.1 reflects high severity: the attack vector is network-based (AV:N), the attack complexity is high (AC:H) due to the ordering dependency in GitHub's response, no privileges or user interaction are required (PR:N/UI:N), the scope is unchanged (S:U), and all three impact dimensions—confidentiality, integrity, and availability—are marked high (C:H/I:H/A:H) because an attacker gaining admin access can read, modify, and disrupt the entire WordPress installation.

Frequently asked questions