What is the CVSS score of CVE-2026-12598?

CVE-2026-12598 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of LoginPress Pro are affected by CVE-2026-12598?

LoginPress Pro WordPress plugin (versions ≤ 6.2.3) with Spotify Social Login enabled contains an authentication bypass enabling unauthenticated attackers to impersonate any user, including…

How to fix or mitigate CVE-2026-12598?

Within 24 hours: Disable the Spotify Social Login addon in LoginPress Pro unless operationally critical; immediately audit all administrator accounts for unauthorized access and review login audit logs for suspicious entries dating back to initial plugin deployment. Within 7 days: Implement multi-factor authentication (MFA) site-wide and restrict WordPress administrative access to whitelisted IP addresses; contact LoginPress to confirm patch status (no vendor-released patch identified at time of analysis) and plan alternative social login solution if timeline remains uncertain. Within 30 days: If no patch is released, migrate to alternative WordPress social login plugin; conduct comprehensive audit of all content modifications, user account changes, and administrative actions during the vulnerability exposure period.

LoginPress Pro CVE-2026-12598

EUVD-2026-42760 HIGH

Improper Authentication (CWE-287)

2026-07-10 security@wordfence.com

GHSA-cvjp-944x-5rjq

WordPress Authentication Bypass

8.1

CVSS 3.1 · Vendor: wordfence

Severity by source

Vendor (wordfence) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Unauthenticated network attack (PR:N/AV:N) with no victim interaction but AC:H for the required non-default Spotify addon and a known target email; admin takeover yields C:H/I:H/A:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (wordfence).

CVSS VectorVendor: wordfence

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 10, 2026 - 00:32 vuln.today

CVE Published

Jul 10, 2026 - 00:16 nvd

HIGH 8.1

DescriptionCVE.org

The LoginPress Pro plugin for WordPress is vulnerable to authentication bypass in versions up to and including 6.2.3 via the Spotify Social Login addon. This is due to the loginpress_on_spotify_login() function trusting the unverified 'email' field returned by Spotify's /v1/me endpoint and using it directly with get_user_by('email', $profile['email']) to identify and log in an existing WordPress account, without confirming that the Spotify user actually owns the email address (Spotify documents that the profile email is unverified) and without requiring the user to prove ownership of the matching WordPress account. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including Administrators, by registering a Spotify account using the targeted user's email address and authenticating via the Spotify provider.

AnalysisAI

Authentication bypass in the LoginPress Pro WordPress plugin (versions ≤ 6.2.3) lets unauthenticated attackers log in as any existing user - including Administrators - when the Spotify Social Login addon is enabled. The flaw stems from the plugin trusting the unverified email returned by Spotify's /v1/me endpoint to match and authenticate a WordPress account, so an attacker who registers a Spotify account with a victim's email gains that victim's session. No public exploit has been identified at time of analysis; CVSS is 8.1 with attack complexity rated High due to the required addon configuration.

Technical ContextAI

The affected component is the Spotify Social Login addon of LoginPress Pro, a commercial extension of the widely used LoginPress WordPress login-customization plugin. The vulnerable code path is loginpress_on_spotify_login(), which consumes the OAuth profile returned by Spotify's Web API /v1/me endpoint and passes the profile's 'email' field directly into WordPress's get_user_by('email', $profile['email']) to locate and log in a matching account. This is a textbook CWE-287 (Improper Authentication): Spotify explicitly documents that the profile email is not verified as owned by the account holder, so using it as an identity assertion conflates 'a Spotify account claims this email' with 'this person controls this email/WordPress account.' The plugin performs no email-ownership confirmation and never requires the user to prove control of the matching WordPress account, collapsing federated login into an identity-spoofing primitive.

RemediationAI

No vendor-released patch version was identified in the provided data; the description confirms only that versions up to and including 6.2.3 are vulnerable, so administrators should monitor https://loginpress.pro/ and the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/bef61f05-a2dc-4f61-a5da-7161a9912196?source=cve) for a fixed release and upgrade to it as soon as available. As an immediate compensating control, disable the Spotify Social Login addon, which fully removes the vulnerable code path at the cost of losing Spotify-based sign-in for legitimate users. If Spotify login must remain enabled, restrict its use to accounts with no email overlap with privileged WordPress users and enforce multi-factor authentication on Administrator accounts so a bypassed password step still cannot yield a full session; note MFA only helps if the social-login flow is itself gated by it. Auditing existing user sessions and administrator accounts for unexpected logins is also advisable given the account-takeover impact.