CVE-2026-12597

Name of the Vulnerable Software and Affected Versions LoginPress Pro versions prior to 6.2.4

Description An authentication bypass exists via the GitHub OAuth callback. The loginpress on github login() function trusts the first element profile[0]['email'] of the array returned by the GitHub /user/emails endpoint as an account-binding identifier without verifying if the email has a verified status. This allows unauthenticated attackers to log in as any existing WordPress user, including administrators, by adding an unverified email address that matches a local account to their GitHub profile and triggering the OAuth callback with a crafted code parameter. This process leads the plugin to call get user by('email', ...) and establish an authenticated session for the matched account. Exploitation depends on GitHub returning the unverified email at index 0 of the response.

Recommendations Update LoginPress Pro to version 6.2.4 or later. As a temporary workaround, restrict the use of the GitHub OAuth login feature until the update is applied.