{"id":13416,"date":"2026-09-04T19:00:06","date_gmt":"2026-09-04T11:00:06","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-12597"},"modified":"2026-09-04T19:00:06","modified_gmt":"2026-09-04T11:00:06","slug":"cve-2026-12597","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-12597","title":{"rendered":"CVE-2026-12597 [HIGH] &#8211; The LoginPress Pro plugin for WordPress is vulnerable to Authentication Bypass via the Git"},"content":{"rendered":"<p>The LoginPress Pro plugin for WordPress is vulnerable to Authentication Bypass via the GitHub OAuth callback in versions up to, and including, 6.2.3. The vulnerability exists in the loginpress_on_github_login() function, which blindly trusts the first element (profile[0][&#8217;email&#8217;]) of the array returned by GitHub&#8217;s \/user\/emails endpoint as an account-binding identifier without verifying that the email carries a verified === true status. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including administrators, by adding an unverified email address matching a local account to their GitHub profile and triggering the OAuth callback via a crafted code parameter \u2014 causing the plugin to call get_user_by(&#8217;email&#8217;, &#8230;) and establish an authenticated session for the matched account. Practical exploitation is conditional on GitHub returning the attacker-added unverified email at index 0 of the \/user\/emails response, as GitHub typically prioritizes the primary verified address first; nonetheless, the absence of any email verification check in the plugin constitutes a fundamental authentication bypass flaw.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The LoginPress Pro plugin for WordPress is vulnerable to Authentication Bypass via the GitHub OAuth callback in versions up to, and including, 6.2.3. The vulnerability exists in the loginpress_on_gith<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-13416","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/13416","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=13416"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=13416"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=13416"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}