CVE-2026-12595: LoginPress Pro Auth Bypass Vulnerability

CVE-2026-12595 Overview

CVE-2026-12595 is an authentication bypass vulnerability in the LoginPress Pro plugin for WordPress affecting all versions up to and including 6.2.3. The flaw resides in the loginpress_on_discord_login() Discord OAuth callback handler, which trusts the email field returned from Discord's /users/@me endpoint without validating the profile's verified flag. Unauthenticated attackers can take over any WordPress account, including administrators, by registering a Discord account with an unverified email address matching the target user.

Critical Impact
Unauthenticated attackers can hijack any WordPress account, including administrators, by abusing the Discord OAuth flow with a spoofed unverified email.

Affected Products

LoginPress Pro plugin for WordPress (all versions ≤ 6.2.3)
WordPress sites with the Discord OAuth login feature enabled
Administrator, editor, and subscriber accounts on affected installations

Discovery Timeline

2026-07-10 - CVE-2026-12595 published to the National Vulnerability Database (NVD)
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-12595

Vulnerability Analysis

The vulnerability is classified as an authentication bypass ([CWE-287]) in the Discord single sign-on (SSO) integration provided by LoginPress Pro. The loginpress_on_discord_login() handler acts as the OAuth callback that consumes the user profile returned by Discord's /users/@me endpoint. The handler extracts the email value from the profile and passes it directly to get_user_by('email', $profile['email']) to locate the matching WordPress account. When a match is found, the handler calls wp_set_auth_cookie() to issue an authenticated session for that account.

Discord returns two relevant fields for each user profile: email and verified. The verified flag indicates whether Discord has confirmed the user actually controls the email address. LoginPress Pro never inspects this flag, so any Discord account may claim any email address.

Root Cause

The root cause is missing verification of an externally supplied trust attribute. The plugin treats the OAuth-provided email as a proof of identity, but Discord permits accounts to register arbitrary unverified email addresses. Without checking $profile['verified'] === true, the identity mapping between Discord identities and WordPress accounts collapses.

Attack Vector

An attacker performs the following steps. The attacker identifies the WordPress email address of a target administrator through user enumeration, public profile data, or leaked credentials. The attacker registers a new Discord account using that email address without completing Discord's email verification. The attacker initiates the standard Discord OAuth flow on the victim WordPress site. The vulnerable callback matches the unverified email to the target's account and sets an authenticated session cookie, granting full account access.

The vulnerability manifests entirely in the OAuth callback logic. See the Wordfence Vulnerability Report for technical details.

Detection Methods for CVE-2026-12595

Indicators of Compromise

Unexpected successful logins to administrator accounts originating from the Discord OAuth callback URL
New WordPress sessions established for high-privilege users without a corresponding password reset or MFA event
Access log entries hitting the loginpress_on_discord_login callback endpoint from unfamiliar IP addresses
Administrative changes such as new plugin installations or user role modifications following a Discord OAuth login

Detection Strategies

Audit WordPress authentication logs for logins where the authentication method is Discord OAuth and the user role is administrator or editor
Correlate LoginPress Pro callback requests with subsequent privileged actions in wp-admin
Enumerate installed plugin versions across the estate and flag any LoginPress Pro instance at version 6.2.3 or earlier
Search web server logs for repeated hits to the Discord OAuth callback endpoint from residential or hosting-provider IP ranges

Monitoring Recommendations

Enable detailed WordPress audit logging for authentication and role change events
Forward web server and WordPress logs to a central SIEM for cross-correlation of OAuth callbacks and administrative activity
Alert on any first-time Discord OAuth login for accounts that hold administrator privileges
Monitor for creation of new administrator users immediately after a Discord OAuth authentication event

How to Mitigate CVE-2026-12595

Immediate Actions Required

Update LoginPress Pro to a version later than 6.2.3 as soon as the vendor publishes a fixed release
Disable the Discord OAuth login provider in LoginPress Pro settings until a patch is applied
Force password resets and invalidate active sessions for all administrator and editor accounts
Review recent administrator activity and roll back any unauthorized changes

Patch Information

Refer to the LoginPress Official Site and the Wordfence Vulnerability Report for the latest patched version and update instructions. Any release beyond 6.2.3 that adds validation of the Discord verified flag remediates the issue.

Workarounds

Deactivate the LoginPress Pro plugin entirely on sites that do not require Discord SSO
Remove or comment out the Discord OAuth provider configuration until patched
Enforce multi-factor authentication (MFA) on all WordPress administrator accounts to add a second factor beyond the OAuth session
Restrict access to wp-admin by IP allowlist at the web server or WAF layer to limit exposure of hijacked sessions

bash

# Configuration example: temporarily disable LoginPress Pro via WP-CLI
wp plugin deactivate loginpress-pro

# Verify the plugin is inactive
wp plugin status loginpress-pro