CVE-2026-12598 Overview
CVE-2026-12598 is an authentication bypass vulnerability in the LoginPress Pro plugin for WordPress, affecting versions up to and including 6.2.3. The flaw resides in the Spotify Social Login addon, which trusts an unverified email address returned by the Spotify /v1/me endpoint. Unauthenticated attackers can log in as any existing WordPress user, including Administrators, by creating a Spotify account with the targeted user's email address and authenticating through the Spotify provider. The vulnerability is tracked under CWE-287: Improper Authentication.
Critical Impact
Unauthenticated attackers can hijack any WordPress account, including Administrator accounts, leading to full site compromise.
Affected Products
- LoginPress Pro plugin for WordPress, versions up to and including 6.2.3
- Installations with the Spotify Social Login addon enabled
- WordPress sites permitting Spotify-based social authentication
Discovery Timeline
- 2026-07-10 - CVE-2026-12598 published to NVD
- 2026-07-10 - Last updated in NVD database
Technical Details for CVE-2026-12598
Vulnerability Analysis
The vulnerability stems from the loginpress_on_spotify_login() function in the Spotify Social Login addon. The function calls Spotify's /v1/me endpoint to retrieve the authenticated user's profile and then uses the returned email field directly with get_user_by('email', $profile['email']). WordPress resolves the matching account and issues a session without any further verification.
Spotify documents that the email address returned by /v1/me is not verified. An attacker registering a Spotify account can supply any email address during signup without proving ownership. When that Spotify identity is used to authenticate against a WordPress site running LoginPress Pro, the plugin treats the email as authoritative and logs the attacker in as the WordPress user who owns that address.
Root Cause
The root cause is the plugin's assumption that a third-party identity provider guarantees email ownership. The addon performs no additional check to confirm the Spotify account holder actually controls the mailbox, and it does not require the user to prove ownership of the corresponding WordPress account through a linking step, secondary factor, or verification token.
Attack Vector
Exploitation requires network access to the target WordPress site and a valid Spotify account. The attacker registers a Spotify account using the targeted victim's email address, initiates the Spotify social login flow on the vulnerable site, and completes OAuth against Spotify. The plugin retrieves the attacker-controlled email, matches it to the victim's WordPress account, and issues an authenticated session. No credentials, tokens, or interaction with the victim are needed. See the Wordfence Vulnerability Report for additional technical detail.
Detection Methods for CVE-2026-12598
Indicators of Compromise
- Successful WordPress logins originating from the Spotify social login handler for privileged accounts that do not normally use social login
- New administrator sessions preceded by requests to the LoginPress Spotify callback endpoint
- Unexpected changes to user roles, plugins, or theme files following a Spotify-initiated login event
- WordPress audit log entries showing login events without a corresponding password authentication
Detection Strategies
- Inspect web server access logs for requests to the Spotify OAuth callback route immediately preceding administrator authentication events
- Correlate WordPress wp_login events with the social login provider used and flag mismatches with historical patterns for each account
- Alert on any first-time Spotify login for accounts holding administrator, editor, or shop_manager roles
Monitoring Recommendations
- Enable a WordPress audit logging plugin that records authentication method and source IP for every login
- Forward WordPress and web server logs to a centralized SIEM for correlation with threat intelligence
- Monitor for creation of new administrator accounts or elevation of existing accounts following social login events
How to Mitigate CVE-2026-12598
Immediate Actions Required
- Update LoginPress Pro to a version later than 6.2.3 as soon as the vendor releases a fix
- Disable the Spotify Social Login addon until a patched version is installed and validated
- Audit administrator and editor accounts for unauthorized logins and rotate credentials for any account that may have been accessed
- Invalidate all active WordPress sessions to force reauthentication after remediation
Patch Information
At the time of publication, refer to the LoginPress official site and the Wordfence Vulnerability Report for the latest patched release information. Apply the vendor-supplied update to all affected sites and verify plugin version 6.2.3 or earlier is no longer running.
Workarounds
- Deactivate the Spotify Social Login addon within LoginPress Pro until the plugin is updated
- Restrict social login to non-privileged roles by preventing administrators and editors from linking Spotify identities
- Enforce multi-factor authentication on all administrator accounts to reduce impact if a bypass occurs
- Restrict access to the WordPress admin area by IP allowlist at the web server or WAF layer
# Disable the LoginPress Pro plugin via WP-CLI while awaiting a patch
wp plugin deactivate loginpress-pro
# Invalidate all active sessions to force reauthentication
wp user session destroy --all
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
