What is the CVSS score of CVE-2026-12597?

CVE-2026-12597 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of WordPress are affected by CVE-2026-12597?

LoginPress Pro WordPress plugin (versions ≤6.2.3) allows unauthenticated attackers to hijack any WordPress account, including administrative access, without requiring a password through a GitHub…

How to fix or mitigate CVE-2026-12597?

24 hours: Identify all WordPress installations using LoginPress Pro versions ≤6.2.3; immediately disable GitHub OAuth social-login functionality or deactivate the LoginPress Pro plugin entirely. 7 days: Audit WordPress access logs for suspicious GitHub OAuth authentication attempts; force password resets for all WordPress user accounts, particularly administrators; document all accounts previously authenticated via GitHub OAuth. 30 days: Monitor LoginPress vendor repository and security advisories for patch release to 6.2.4 or later; upon patch availability, test in staging environment and deploy immediately; conduct post-incident security audit.

WordPress CVE-2026-12597

EUVD-2026-42758 HIGH

Improper Authentication (CWE-287)

2026-07-10 security@wordfence.com

GHSA-g678-2jj9-7fmj

WordPress Authentication Bypass

8.1

CVSS 3.1 · Vendor: wordfence

Severity by source

Vendor (wordfence) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (wordfence) · only source for this CVE.

CVSS VectorVendor: wordfence

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 10, 2026 - 00:30 vuln.today

CVE Published

Jul 10, 2026 - 00:16 nvd

HIGH 8.1

DescriptionCVE.org

The LoginPress Pro plugin for WordPress is vulnerable to Authentication Bypass via the GitHub OAuth callback in versions up to, and including, 6.2.3. The vulnerability exists in the loginpress_on_github_login() function, which blindly trusts the first element (profile[0]['email']) of the array returned by GitHub's /user/emails endpoint as an account-binding identifier without verifying that the email carries a verified === true status. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including administrators, by adding an unverified email address matching a local account to their GitHub profile and triggering the OAuth callback via a crafted code parameter - causing the plugin to call get_user_by('email', ...) and establish an authenticated session for the matched account. Practical exploitation is conditional on GitHub returning the attacker-added unverified email at index 0 of the /user/emails response, as GitHub typically prioritizes the primary verified address first; nonetheless, the absence of any email verification check in the plugin constitutes a fundamental authentication bypass flaw.

AnalysisAI

Authentication bypass in the LoginPress Pro WordPress plugin (versions up to and including 6.2.3) lets unauthenticated attackers hijack any existing account, including administrators, by abusing the GitHub OAuth social-login callback. The loginpress_on_github_login() function binds the login session to profile[0]['email'] from GitHub's /user/emails endpoint without checking the verified flag, so an attacker who adds an unverified email matching a victim's account and triggers the callback can be logged in as that user. This maps to CWE-287 and carries a CVSS 8.1; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.