Executive brief
LoginPress Pro is a WordPress plugin used to customize login pages and provide social login options. A security flaw in its GitHub login feature allows an attacker to bypass authentication and log in as any user, including administrators. By using a GitHub account with an unverified email address that matches a target WordPress user's email, an attacker can gain full control over the website.
Technical details
The vulnerability exists in the loginpress_on_github_login() function, which fails to verify the 'verified' status of email addresses returned by the GitHub /user/emails endpoint. The plugin blindly trusts the first email address in the array (profile[0]['email']) as a valid identifier for account binding. An unauthenticated attacker can exploit this by adding an unverified email address to their GitHub profile that matches an existing WordPress user's email. When the OAuth callback is triggered, the plugin calls get_user_by() using the unverified email and establishes an authenticated session. Exploitation depends on GitHub returning the unverified email at the first index of the response array.
Affected products
- LoginPress LoginPress Pro up to, and including, 6.2.3
Timeline
- 2026-07-10: disclosed: NVD publication date