EUVD-2026-42759
GHSA-m2h5-jwrw-x8mr
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable OAuth callback with no auth or interaction (PR:N/UI:N), but AC:H because it needs the non-default Discord login feature enabled and knowledge of the victim's email; full account takeover yields C:H/I:H/A:H.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
2DescriptionCVE.org
The LoginPress Pro plugin for WordPress is vulnerable to Authentication Bypass via Unverified OAuth Email in all versions up to and including 6.2.3. The vulnerability exists in the loginpress_on_discord_login() Discord OAuth callback handler, which accepts the email field returned by Discord's /users/@me endpoint without ever checking that the profile's verified flag is true, then directly maps that email to a local WordPress account via get_user_by('email', $profile['email']) and issues an authenticated session cookie via wp_set_auth_cookie(). This makes it possible for unauthenticated attackers to take over any existing WordPress account - including administrator accounts - by registering a Discord account configured with an unverified email address that matches the target user's registered WordPress email and completing the standard Discord OAuth flow.
AnalysisAI
Authentication bypass in the LoginPress Pro WordPress plugin (versions ≤ 6.2.3) lets unauthenticated attackers hijack any existing account - administrators included - by exploiting the Discord OAuth login handler, which trusts the email returned by Discord without checking Discord's verified flag. An attacker who knows a target's WordPress email registers a Discord account with that same (unverified) email and completes the normal OAuth flow to receive an authenticated session as the victim. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw was reported by Wordfence and is a full account-takeover primitive.
Technical ContextAI
The issue is a CWE-287 (Improper Authentication) flaw in the plugin's social-login integration with Discord's OAuth2 provider. In the loginpress_on_discord_login() callback, the plugin reads the email field from Discord's /users/@me endpoint and passes it straight to get_user_by('email', $profile['email']), then calls wp_set_auth_cookie() to establish a logged-in session. Discord returns both an email and a boolean verified property indicating whether the user has proven control of that address; because Discord allows an account to hold an unverified email, the verified flag is the security-critical control. By ignoring it, the plugin treats attacker-asserted email ownership as authenticated identity, collapsing the trust boundary between 'Discord says this address' and 'this user controls this address.' The affected component is the Discord OAuth branch of LoginPress Pro's login flow; the underlying WordPress account identity model (email-as-identifier) is otherwise standard.
RemediationAI
No vendor-released patched version is identified in the available data - the advisory states the flaw affects all versions up to and including 6.2.3, so administrators should upgrade to the first LoginPress Pro release above 6.2.3 once published and confirmed by the vendor (verify via https://loginpress.pro/ and the Wordfence entry at https://www.wordfence.com/threat-intel/vulnerabilities/id/5949980f-2506-49be-9105-40ec2d2a4f77?source=cve). Until a fixed version is confirmed, the most effective compensating control is to disable the Discord OAuth / social-login option in LoginPress Pro entirely, which removes the vulnerable code path at the cost of forcing users back to standard WordPress credentials. Where Discord login must remain, restrict administrative logins to password-plus-MFA and avoid provisioning admin accounts whose email could be guessed or is publicly known, since the attack hinges on matching the victim's registered email. As a detective control, monitor authentication logs for unexpected admin sessions originating from the Discord login callback.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today