CVE-2026-12598: LoginPress Pro Spotify Social Login Authentication Bypass (CVSS 8.1)

Technical summary

The loginpress_on_spotify_login() function in the Spotify Social Login addon trusts the 'email' field returned by Spotify's /v1/me endpoint and immediately uses it to look up and authenticate an existing WordPress user via get_user_by('email', $profile['email']). This design overlooks two critical security gaps: Spotify's own documentation states that profile email addresses are unverified, and the plugin performs no verification that the Spotify account owner actually controls the target WordPress email address. An unauthenticated attacker can register a Spotify account with any email address (including one they do not own), authenticate via the plugin's Spotify provider integration, and be logged in as the WordPress user associated with that email.

Business impact

Compromise of administrator and privileged user accounts exposes WordPress sites to complete takeover, data theft, malware injection, and defacement. Attackers can modify site content, steal customer data, install backdoors, or use the compromised site for further attacks against your customers or partners. For multi-user WordPress installations, especially those handling sensitive content or commerce, this vulnerability creates immediate and severe operational risk.

Affected systems

LoginPress Pro plugin versions up to and including 6.2.3 that have the Spotify Social Login addon enabled. Any WordPress installation with this configuration where the Spotify login method is accessible to unauthenticated users is vulnerable. The vulnerability does not require specific WordPress versions, themes, or other plugins—only the affected LoginPress Pro version and an active Spotify social login integration.

Exploitability

Exploitation requires no special technical skills beyond creating a free Spotify account and navigating to the WordPress site's login interface. No user interaction is required from the target. An attacker does not need to know passwords, possess valid credentials, or perform complex exploitation steps. The attack surface is as wide as any WordPress site exposing the Spotify login option. The CVSS score of 8.1 (HIGH) reflects high attack complexity due to the requirement to predict or know the target email address and the attacker's reliance on Spotify's account registration process, but this remains a practical threat in real-world scenarios where email addresses are often discoverable or predictable.

Remediation

Immediately update the LoginPress Pro plugin to a patched version released after 6.2.3—verify the exact version number in the official plugin repository or vendor advisory, as patches may be released incrementally. If an immediate patch is unavailable, disable the Spotify Social Login addon or remove the LoginPress Pro plugin entirely until a fix is available. As a temporary mitigation, disable social login features and enforce standard WordPress authentication or use alternative, security-vetted authentication plugins.

Patch guidance

Check the LoginPress Pro plugin repository or the plugin vendor's security advisory for version 6.2.4 or later. Update through the WordPress admin dashboard (Plugins → Updates) once a patched version is confirmed available. After updating, test the Spotify login flow with a test account to ensure functionality is restored. Document the update in your change log for compliance and audit purposes. If you are running an older version of WordPress or have compatibility concerns, verify patch compatibility before deploying to production.

Detection guidance

Monitor WordPress login logs and authentication attempts for successful logins originating from the Spotify social login flow that do not correspond to expected user patterns (e.g., logins at unusual times or from unexpected geographic regions). Check WordPress user accounts, especially administrator accounts, for unauthorized creation dates or recent privilege changes. If your WordPress installation logs Spotify API calls, search for suspicious /v1/me endpoint requests or unexpected email-based user lookups. Audit the LoginPress Pro plugin's activity logs if available. Review Spotify account creation activity for your organization's email domain for unexpected accounts.

Why prioritize this

This vulnerability warrants immediate patching due to its high severity score (8.1), unauthenticated attack vector, and potential for complete account compromise of privileged users. The attack is trivial to execute and requires no special knowledge, making it an attractive target for opportunistic attackers. The widespread use of WordPress and social login features across small and large organizations increases the likelihood of exploitation.

Risk score, explained

The CVSS 3.1 score of 8.1 (HIGH) is driven by high confidentiality, integrity, and availability impact (a compromised account can access and modify all account-associated data and functionality), an unauthenticated attack vector (no login required), and no privilege escalation required. The attack complexity is rated as high primarily due to the attacker's need to either know or guess the target email address and the requirement to interact with Spotify's account registration. However, in practice, email addresses are often public or easily discovered, and Spotify registration is unrestricted, making the theoretical 'high complexity' less restrictive in real-world attacks.

Frequently asked questions