Is CVE-2026-12597 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-12597 being exploited in the wild.

How severe is CVE-2026-12597?

High severity, with a CVSS score of 8.1, published 10 July 2026.

Which products and versions are affected?

LoginPress Pro up to, and including, 6.2.3.

Is there a fix for CVE-2026-12597?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-12597 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-12597?

Check whether you run LoginPress Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12597: LoginPress Pro authentication bypass in GitHub OAuth callback

CVE-2026-12597 · Severity: high · CVSS 8.1 · Published 2026-07-10

LoginPress Pro is a WordPress plugin used to customize login pages and provide social login options. A security flaw in its GitHub login feature allows an attacker to bypass authentication and log in as any user, including administrators. By using a GitHub account with an unverified email address that matches a target WordPress user's email, an attacker can gain full control over the website.

Technologies: LoginPress Pro. Vendors: LoginPress.

Quick answers

Is CVE-2026-12597 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-12597 being exploited in the wild.
How severe is CVE-2026-12597?: High severity, with a CVSS score of 8.1, published 10 July 2026.
Which products and versions are affected?: LoginPress Pro up to, and including, 6.2.3.
Is there a fix for CVE-2026-12597?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-12597 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-12597?: Check whether you run LoginPress Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the loginpress_on_github_login() function, which fails to verify the 'verified' status of email addresses returned by the GitHub /user/emails endpoint. The plugin blindly trusts the first email address in the array (profile[0]['email']) as a valid identifier for account binding. An unauthenticated attacker can exploit this by adding an unverified email address to their GitHub profile that matches an existing WordPress user's email. When the OAuth callback is triggered, the plugin calls get_user_by() using the unverified email and establishes an authenticated session. Exploitation depends on GitHub returning the unverified email at the first index of the response array.

Affected products

LoginPress LoginPress Pro up to, and including, 6.2.3

Timeline

2026-07-10: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.