Executive brief
LoginPress Pro is a WordPress plugin used to customize login pages and provide social login options. A security flaw in its Spotify login feature allows attackers to bypass authentication and gain full access to any user account, including administrator accounts. This occurs because the plugin does not verify if a user actually owns the email address associated with their Spotify profile before logging them into the website. An attacker could use this to take over a site, steal data, or disrupt operations by simply creating a Spotify account with a target's email address.
Technical details
The LoginPress Pro plugin for WordPress is vulnerable to an authentication bypass in the Spotify Social Login addon due to improper identity verification in the loginpress_on_spotify_login() function. The plugin retrieves the 'email' field from Spotify's /v1/me endpoint and uses it to identify and authenticate a WordPress user via get_user_by() without verifying that the email address has been validated by Spotify. Since Spotify allows unverified emails in user profiles, an unauthenticated attacker can register a Spotify account using a target's email address (such as an administrator's) and successfully log in to the WordPress site. The vulnerability is present in versions up to and including 6.2.3.
Affected products
- LoginPress LoginPress Pro up to and including 6.2.3
Timeline
- 2026-07-10: disclosed: NVD publication date