CVE-2026-12598: LoginPress Pro Auth Bypass Vulnerability

CVE-2026-12598 Overview

CVE-2026-12598 is an authentication bypass vulnerability in the LoginPress Pro plugin for WordPress, affecting versions up to and including 6.2.3. The flaw resides in the Spotify Social Login addon, which trusts an unverified email address returned by the Spotify /v1/me endpoint. Unauthenticated attackers can log in as any existing WordPress user, including Administrators, by creating a Spotify account with the targeted user's email address and authenticating through the Spotify provider. The vulnerability is tracked under CWE-287: Improper Authentication.

Critical Impact
Unauthenticated attackers can hijack any WordPress account, including Administrator accounts, leading to full site compromise.

Affected Products

LoginPress Pro plugin for WordPress, versions up to and including 6.2.3
Installations with the Spotify Social Login addon enabled
WordPress sites permitting Spotify-based social authentication

Discovery Timeline

2026-07-10 - CVE-2026-12598 published to NVD
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-12598

Vulnerability Analysis

The vulnerability stems from the loginpress_on_spotify_login() function in the Spotify Social Login addon. The function calls Spotify's /v1/me endpoint to retrieve the authenticated user's profile and then uses the returned email field directly with get_user_by('email', $profile['email']). WordPress resolves the matching account and issues a session without any further verification.

Spotify documents that the email address returned by /v1/me is not verified. An attacker registering a Spotify account can supply any email address during signup without proving ownership. When that Spotify identity is used to authenticate against a WordPress site running LoginPress Pro, the plugin treats the email as authoritative and logs the attacker in as the WordPress user who owns that address.

Root Cause

The root cause is the plugin's assumption that a third-party identity provider guarantees email ownership. The addon performs no additional check to confirm the Spotify account holder actually controls the mailbox, and it does not require the user to prove ownership of the corresponding WordPress account through a linking step, secondary factor, or verification token.

Attack Vector

Exploitation requires network access to the target WordPress site and a valid Spotify account. The attacker registers a Spotify account using the targeted victim's email address, initiates the Spotify social login flow on the vulnerable site, and completes OAuth against Spotify. The plugin retrieves the attacker-controlled email, matches it to the victim's WordPress account, and issues an authenticated session. No credentials, tokens, or interaction with the victim are needed. See the Wordfence Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-12598

Indicators of Compromise

Successful WordPress logins originating from the Spotify social login handler for privileged accounts that do not normally use social login
New administrator sessions preceded by requests to the LoginPress Spotify callback endpoint
Unexpected changes to user roles, plugins, or theme files following a Spotify-initiated login event
WordPress audit log entries showing login events without a corresponding password authentication

Detection Strategies

Inspect web server access logs for requests to the Spotify OAuth callback route immediately preceding administrator authentication events
Correlate WordPress wp_login events with the social login provider used and flag mismatches with historical patterns for each account
Alert on any first-time Spotify login for accounts holding administrator, editor, or shop_manager roles

Monitoring Recommendations

Enable a WordPress audit logging plugin that records authentication method and source IP for every login
Forward WordPress and web server logs to a centralized SIEM for correlation with threat intelligence
Monitor for creation of new administrator accounts or elevation of existing accounts following social login events

How to Mitigate CVE-2026-12598

Immediate Actions Required

Update LoginPress Pro to a version later than 6.2.3 as soon as the vendor releases a fix
Disable the Spotify Social Login addon until a patched version is installed and validated
Audit administrator and editor accounts for unauthorized logins and rotate credentials for any account that may have been accessed
Invalidate all active WordPress sessions to force reauthentication after remediation

Patch Information

At the time of publication, refer to the LoginPress official site and the Wordfence Vulnerability Report for the latest patched release information. Apply the vendor-supplied update to all affected sites and verify plugin version 6.2.3 or earlier is no longer running.

Workarounds

Deactivate the Spotify Social Login addon within LoginPress Pro until the plugin is updated
Restrict social login to non-privileged roles by preventing administrators and editors from linking Spotify identities
Enforce multi-factor authentication on all administrator accounts to reduce impact if a bypass occurs
Restrict access to the WordPress admin area by IP allowlist at the web server or WAF layer

bash

# Disable the LoginPress Pro plugin via WP-CLI while awaiting a patch
wp plugin deactivate loginpress-pro

# Invalidate all active sessions to force reauthentication
wp user session destroy --all