What is the CVSS score of CVE-2026-49058?

CVE-2026-49058 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of LoginPress Pro are affected by CVE-2026-49058?

LoginPress Pro WordPress plugin versions 6.2.2 and earlier contain a critical unauthenticated privilege escalation vulnerability (CVSS 9.8) enabling remote attackers to obtain full administrator…

How to fix or mitigate CVE-2026-49058?

Within 24 hours: Inventory all WordPress installations using LoginPress Pro versions ≤6.2.2; immediately disable the plugin or restrict WordPress login page access via IP allowlist and Web Application Firewall rules as emergency containment. Within 7 days: Contact LoginPress vendor for patch timeline and ETA; prepare change control procedures and test patch deployment in non-production environment. Within 30 days: Apply vendor-released patch to all affected systems and validate functionality before production restoration.

LoginPress Pro CVE-2026-49058

EUVD-2026-37613 CRITICAL

Incorrect Privilege Assignment (CWE-266)

2026-06-17 Patchstack

WordPress Privilege Escalation Wordpress Plugin Loginpress Pro Loginpress

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable WordPress plugin endpoint with no user interaction yields privilege escalation to admin, giving full C/I/A impact on the site.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 12:06 vuln.today

DescriptionCVE.org

Unauthenticated Privilege Escalation in LoginPress Pro <= 6.2.2 versions.

AnalysisAI

Unauthenticated privilege escalation in LoginPress Pro WordPress plugin versions 6.2.2 and earlier allows remote attackers without credentials to elevate privileges on affected WordPress sites. Reported by Patchstack with a CVSS 9.8 critical rating, the flaw maps to CWE-266 (Incorrect Privilege Assignment) and no public exploit identified at time of analysis. Given the plugin's role in customizing WordPress login flows, a successful attacker could obtain administrator-level access to the underlying site.

Technical ContextAI

LoginPress Pro is a commercial WordPress plugin (CPE cpe:2.3:a:loginpress:loginpress_pro) used to customize and harden the WordPress wp-login.php experience, including branding, two-factor add-ons, and limit-login features. The CWE-266 classification (Incorrect Privilege Assignment) indicates that the plugin assigns a user a privilege level or role that should not be granted under the given conditions - typically via a WordPress AJAX, REST, or admin-post handler that fails to enforce capability checks (current_user_can) or nonce verification before mutating user meta, roles, or capabilities. Because the issue is unauthenticated, the vulnerable code path is reachable without a valid WordPress session, meaning a public-facing endpoint exposed by the plugin is performing privileged actions without a proper authorization gate.

RemediationAI

Patch available per vendor advisory: upgrade LoginPress Pro to the version released after 6.2.2 as listed in the Patchstack record at https://patchstack.com/database/wordpress/plugin/loginpress-pro/vulnerability/wordpress-loginpress-pro-plugin-6-2-2-privilege-escalation-vulnerability; the exact fixed version is not independently confirmed in the input data and should be verified against the LoginPress changelog before deployment. Until upgrade is possible, deactivate and remove the LoginPress Pro plugin (the site will revert to the default wp-login.php experience and lose branding/2FA features the plugin provided), or place the affected endpoints behind a WAF rule that blocks unauthenticated requests to the plugin's AJAX/REST routes (risk: false positives on legitimate login customization traffic). Audit existing WordPress users for unexpected administrator or editor roles created since the plugin was installed, since pre-patch exploitation would leave behind elevated accounts that a patch alone will not remove.