Is CVE-2026-12595 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-12595 being exploited in the wild.

How severe is CVE-2026-12595?

High severity, with a CVSS score of 8.1, published 10 July 2026.

Which products and versions are affected?

LoginPress / WPBrigade LoginPress Pro up to and including 6.2.3.

Is there a fix for CVE-2026-12595?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-12595 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-12595?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12595: LoginPress Pro authentication bypass via unverified Discord OAuth email

CVE-2026-12595 · Severity: high · CVSS 8.1 · Published 2026-07-10

LoginPress Pro is a WordPress plugin used to customize login pages and provide social login options. A security flaw in its Discord login feature allows attackers to bypass authentication and take over any user account, including administrator accounts. This occurs because the plugin fails to verify if a Discord user's email address has been confirmed, allowing an attacker to spoof a target's email and gain full access to their website.

Quick answers

Is CVE-2026-12595 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-12595 being exploited in the wild.
How severe is CVE-2026-12595?: High severity, with a CVSS score of 8.1, published 10 July 2026.
Which products and versions are affected?: LoginPress / WPBrigade LoginPress Pro up to and including 6.2.3.
Is there a fix for CVE-2026-12595?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-12595 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-12595?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the loginpress_on_discord_login() Discord OAuth callback handler. The component accepts the email field from Discord's /users/@me endpoint without verifying the 'verified' boolean flag. It then uses this unverified email to look up a local WordPress user via get_user_by() and immediately establishes an authenticated session using wp_set_auth_cookie(). An unauthenticated attacker can exploit this by creating a Discord account with an unverified email address matching a target WordPress user (such as an admin) and completing the OAuth flow to gain unauthorized access.

Affected products

LoginPress / WPBrigade LoginPress Pro up to and including 6.2.3

Timeline

2026-07-10: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.