CVE-2026-12595 LoginPress Pro <= 6.2.3 - Unauthenticated Authentication Bypass via Unverified OAuth Email via Discord OAuth Callback
Unauthenticated attackers can take over any WordPress account, including administrators, by exploiting unverified Discord OAuth email validation in LoginPress Pro.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-12595?
CVE-2026-12595 is a high-severity authentication bypass vulnerability in LoginPress Pro, published on 9 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The LoginPress Pro plugin for WordPress is vulnerable to Authentication Bypass via Unverified OAuth Email in all versions up to and including 6.2.3. The vulnerability exists in the loginpress_on_discord_login() Discord OAuth callback handler, which accepts the email field returned by Discord's /users/@me endpoint without ever checking that the profile's verified flag is true, then directly maps that email to a local WordPress account via get_user_by('email', $profile['email']) and issues an authenticated session cookie via wp_set_auth_cookie(). This makes it possible for unauthenticated attackers to take over any existing WordPress account — including administrator accounts — by registering a Discord account configured with an unverified email address that matches the target user's registered WordPress email and completing the standard Discord OAuth flow.
Weakness: CWE-287
Which versions are affected by CVE-2026-12595?
How do I fix CVE-2026-12595?
No fix has been published for CVE-2026-12595 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-12595 being exploited?
There is no known exploitation of CVE-2026-12595 in the wild and no public exploit code.
Sources
Also known as GHSA-m2h5-jwrw-x8mr.