Executive brief
LoginPress Pro is a WordPress plugin used to customize login pages and provide social login options. A security flaw in its Discord login feature allows attackers to bypass authentication and take over any user account, including administrator accounts. This occurs because the plugin fails to verify if a Discord user's email address has been confirmed, allowing an attacker to spoof a target's email and gain full access to their website.
Technical details
The vulnerability exists in the loginpress_on_discord_login() Discord OAuth callback handler. The component accepts the email field from Discord's /users/@me endpoint without verifying the 'verified' boolean flag. It then uses this unverified email to look up a local WordPress user via get_user_by() and immediately establishes an authenticated session using wp_set_auth_cookie(). An unauthenticated attacker can exploit this by creating a Discord account with an unverified email address matching a target WordPress user (such as an admin) and completing the OAuth flow to gain unauthorized access.
Affected products
- LoginPress / WPBrigade LoginPress Pro up to and including 6.2.3
Timeline
- 2026-07-10: advisory: NVD publication date