CVE-2026-12595

Name of the Vulnerable Software and Affected Versions LoginPress Pro versions prior to 6.2.4

Description An authentication bypass exists in the Discord OAuth callback handler loginpress on discord login(). The handler processes the email field from the Discord /users/@me endpoint without verifying if the profile's verified flag is true. It then maps this email to a local WordPress account using get user by('email', $profile['email']) and issues an authenticated session cookie via wp set auth cookie(). This allows an unauthenticated attacker to take over any WordPress account, including administrator accounts, by creating a Discord account with an unverified email that matches the target user's WordPress email and completing the OAuth flow.

Recommendations Update LoginPress Pro to version 6.2.4 or later.