Auth bypass in Loginpress Pro
CVE-2026-12598
The LoginPress Pro plugin for WordPress is vulnerable to authentication bypass in versions up to and including 6.2.3 via the Spotify Social Login addon. This is due to the loginpress_on_spotify_login() function trusting the unverified 'ema…
Vulnerability class: Broken Authentication
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Loginpress Pro — versions 0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-12598?
- CVE-2026-12598 is a high-severity vulnerability in Loginpress Pro, classified under Improper Authentication. CVSS score: 8.1/10. Published 2026-07-10.
- How severe is CVE-2026-12598?
- High severity. CVSS v3 base score is 8.1 out of 10.