EUVD-2026-37613Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site running LoginPress Pro
-
DeliverySend crafted request to vulnerable plugin endpoint
-
ExploitTrigger incorrect privilege assignment
-
ExecutionObtain administrator-level access
-
PersistInstall malicious plugin or backdoor
-
ImpactExfiltrate data and persist
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Privilege assignment review
|
| Exploitation Conditions | Target WordPress site must have the LoginPress Pro plugin installed and activated at version 6.2.2 or earlier, with the plugin's HTTP endpoints reachable by the attacker (the standard WordPress deployment exposes wp-admin/admin-ajax.php and wp-json REST routes publicly). No authentication, no user interaction, and no non-default plugin configuration are required per the CVSS vector AV:N/AC:L/PR:N/UI:N. The only limiting factors are LoginPress Pro being a paid product (reducing total install base versus the free edition) and the attacker needing to know or fingerprint that the plugin is present on the target. |
| Impact | All available signals point to high real-world risk: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N is the worst-case profile (remote, low complexity, no privileges, no user interaction) and the C:H/I:H/A:H impact translates directly to full WordPress site compromise. The base score of 9.8 is consistent with the description of unauthenticated privilege escalation. No EPSS score, KEV listing, or SSVC decision is provided in the input, so probability of exploitation cannot be quantified, but WordPress plugin vulnerabilities of this class are routinely automated by mass-scanning botnets shortly after disclosure. The only mitigating factor visible is that LoginPress Pro is a paid plugin with a smaller install base than its free counterpart, which somewhat narrows the attack surface but does not reduce per-site severity. |
| Exploit ScenarioDerived | An attacker scans the internet for WordPress sites running LoginPress Pro, then issues a crafted unauthenticated HTTP request to the vulnerable plugin endpoint to grant themselves (or a newly created account) administrator privileges. With admin access they install a malicious plugin or theme to achieve full RCE, exfiltrate the WordPress database, and persist via a backdoor user - all without any credentials or user interaction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 17, 2026
Unauthenticated privilege escalation in LoginPress Pro WordPress plugin versions 6.2.2 and earlier allows remote attackers without credentials to elevate privileges on affected WordPress sites. Reported by Patchstack with a CVSS 9.8 critical rating, the flaw maps to CWE-266 (Incorrect Privilege Assignment) and no public exploit identified at time of analysis. Given the plugin's role in customizing WordPress login flows, a successful attacker could obtain administrator-level access to the underlying site.
RemediationAI
Patch available per vendor advisory: upgrade LoginPress Pro to the version released after 6.2.2 as listed in the Patchstack record at https://patchstack.com/database/wordpress/plugin/loginpress-pro/vulnerability/wordpress-loginpress-pro-plugin-6-2-2-privilege-escalation-vulnerability; the exact fixed version is not independently confirmed in the input data and should be verified against the LoginPress changelog before deployment. Until upgrade is possible, deactivate and remove the LoginPress Pro plugin (the site will revert to the default wp-login.php experience and lose branding/2FA features the plugin provided), or place the affected endpoints behind a WAF rule that blocks unauthenticated requests to the plugin's AJAX/REST routes (risk: false positives on legitimate login customization traffic). Audit existing WordPress users for unexpected administrator or editor roles created since the plugin was installed, since pre-patch exploitation would leave behind elevated accounts that a patch alone will not remove.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
LoginPress Pro is a commercial WordPress plugin (CPE cpe:2.3:a:loginpress:loginpress_pro) used to customize and harden the WordPress wp-login.php experience, including branding, two-factor add-ons, and limit-login features. The CWE-266 classification (Incorrect Privilege Assignment) indicates that the plugin assigns a user a privilege level or role that should not be granted under the given conditions - typically via a WordPress AJAX, REST, or admin-post handler that fails to enforce capability checks (current_user_can) or nonce verification before mutating user meta, roles, or capabilities. Because the issue is unauthenticated, the vulnerable code path is reachable without a valid WordPress session, meaning a public-facing endpoint exposed by the plugin is performing privileged actions without a proper authorization gate.
Know when Loginpress Pro gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable WordPress plugin endpoint with no user interaction yields privilege escalation to admin, giving full C/I/A impact on the site.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Privilege Escalation in LoginPress Pro <= 6.2.2 versions.
Executive ViewAI
LoginPress Pro WordPress plugin versions 6.2.2 and earlier contain a critical unauthenticated privilege escalation vulnerability (CVSS 9.8) enabling remote attackers to obtain full administrator access without credentials; no public exploit identified at time of analysis. This poses immediate risk of complete site compromise, data theft, and malicious injection across all affected installations. Organizations must implement emergency containment immediately while awaiting vendor patch.
No vendor-released patch identified at time of analysis. Implement interim mitigations: (1) disable LoginPress Pro plugin on all WordPress sites until vendor patch released; (2) deploy Web Application Firewall (WAF) rules to detect and block privilege escalation exploitation attempts; (3) restrict WordPress administration panel access to known corporate IP ranges; (4) enable real-time alerting on user privilege escalation events and administrative account creation; (5) increase audit logging coverage for authentication, authorization changes, and role modifications.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
GitHub PoC
Exploit-DB