CVE-2026-12597: LoginPress Pro Auth Bypass Vulnerability

CVE-2026-12597 Overview

CVE-2026-12597 is an authentication bypass vulnerability in the LoginPress Pro plugin for WordPress affecting versions up to and including 6.2.3. The flaw resides in the loginpress_on_github_login() function, which processes the GitHub OAuth callback. The function trusts the first entry of the array returned by GitHub's /user/emails endpoint as an account-binding identifier without confirming the verified === true status. Unauthenticated attackers can log in as any existing WordPress user, including administrators, by adding an unverified email that matches a local account to their GitHub profile. The weakness is classified under [CWE-287: Improper Authentication].

Critical Impact
Unauthenticated attackers can hijack administrator accounts on WordPress sites running LoginPress Pro by abusing unverified GitHub email addresses during OAuth login.

Affected Products

LoginPress Pro plugin for WordPress, versions up to and including 6.2.3
WordPress installations using GitHub OAuth login via LoginPress Pro
Any site permitting social login through the affected plugin's GitHub provider

Discovery Timeline

2026-07-10 - CVE-2026-12597 published to NVD
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-12597

Vulnerability Analysis

The LoginPress Pro plugin implements GitHub OAuth as an alternative authentication path for WordPress sites. When a user completes the GitHub OAuth flow, the plugin exchanges the code parameter for an access token and calls GitHub's /user/emails endpoint. The loginpress_on_github_login() function then reads profile[0]['email'] and passes that string to get_user_by('email', ...). If a WordPress account exists with that email, the plugin establishes an authenticated session for that account without verifying that GitHub confirmed ownership of the email address.

GitHub's /user/emails endpoint returns every email attached to the profile, both verified and unverified, each with a verified boolean field. The plugin ignores this flag entirely. An attacker can add an arbitrary email such as the administrator's WordPress email to their own GitHub account and complete OAuth without ever proving control of that mailbox.

Root Cause

The root cause is missing verification of the verified attribute on entries returned by GitHub's email API. Trusting the first array element as an authoritative identity claim conflates "claimed by the user" with "proven by the provider." Social login flows must treat unverified email addresses as attacker-controlled input and reject them as account binding keys.

Attack Vector

An attacker adds the target WordPress account's email to their own GitHub profile without completing GitHub's email verification. The attacker then triggers the LoginPress Pro GitHub OAuth callback with a crafted code parameter. If GitHub returns the unverified attacker-added email at index 0 of the /user/emails response, the plugin binds the OAuth session to the local WordPress user matching that email. Practical exploitation depends on GitHub's ordering behavior, since the primary verified address is typically returned first. The absence of any verification check nonetheless establishes a fundamental authentication bypass reachable over the network without user interaction.

Detection Methods for CVE-2026-12597

Indicators of Compromise

Successful WordPress logins to privileged accounts immediately following requests to the LoginPress GitHub OAuth callback endpoint.
New administrator sessions originating from IP addresses or user agents not previously associated with the target account.
WordPress audit logs showing GitHub OAuth-sourced logins for accounts whose owners did not initiate a GitHub sign-in.
Unexpected plugin, theme, or user modifications performed shortly after a GitHub OAuth callback event.

Detection Strategies

Review web server access logs for requests to the LoginPress GitHub OAuth callback path carrying a code parameter followed by authenticated session cookies for high-value accounts.
Correlate WordPress authentication events with the source login method and flag GitHub-sourced authentications for accounts that do not have GitHub linked in normal workflows.
Deploy WordPress security plugins or a web application firewall capable of logging OAuth callback invocations and matching them to session establishment events.

Monitoring Recommendations

Enable verbose authentication logging in WordPress and forward events to a centralized logging platform for correlation.
Alert on any administrator-level login that occurs through a social login provider when local password authentication is the expected path.
Monitor for changes to the wp_users table, new administrator role assignments, and modifications to plugin or theme files following OAuth callback activity.

How to Mitigate CVE-2026-12597

Immediate Actions Required

Update LoginPress Pro to a version later than 6.2.3 once the vendor publishes a patched release.
Disable the GitHub OAuth login provider within LoginPress Pro configuration until the patched version is deployed.
Force password resets and terminate active sessions for all administrator and editor accounts as a precaution.
Audit the WordPress user table for unauthorized administrator accounts or role escalations.

Patch Information

At the time of publication, refer to the Wordfence Vulnerability Report and the LoginPress Official Site for the current fixed version. The corrected implementation must iterate over the /user/emails response and only accept entries where verified === true as valid account-binding identifiers.

Workarounds

Deactivate the GitHub OAuth authentication method in LoginPress Pro settings until an updated version is installed.
Enforce two-factor authentication on all WordPress accounts so that a hijacked OAuth session cannot complete a privileged login without a second factor.
Restrict administrative panel access by IP allowlisting through the web server or a web application firewall.
Remove or restrict administrator email addresses from being reused as public identifiers where feasible.

bash

# Configuration example: disable GitHub OAuth via WP-CLI until patch is applied
wp option patch update loginpress_pro_settings github_login_enabled 0
wp cache flush