Is CVE-2026-12598 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-12598 being exploited in the wild.

How severe is CVE-2026-12598?

High severity, with a CVSS score of 8.1, published 10 July 2026.

Which products and versions are affected?

LoginPress Pro up to and including 6.2.3.

Is there a fix for CVE-2026-12598?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-12598 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-12598?

Check whether you run LoginPress Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12598: LoginPress Pro authentication bypass in Spotify Social Login addon

CVE-2026-12598 · Severity: high · CVSS 8.1 · Published 2026-07-10

LoginPress Pro is a WordPress plugin used to customize login pages and provide social login options. A security flaw in its Spotify login feature allows attackers to bypass authentication and gain full access to any user account, including administrator accounts. This occurs because the plugin does not verify if a user actually owns the email address associated with their Spotify profile before logging them into the website. An attacker could use this to take over a site, steal data, or disrupt operations by simply creating a Spotify account with a target's email address.

Technologies: LoginPress Pro. Vendors: LoginPress.

Quick answers

Is CVE-2026-12598 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-12598 being exploited in the wild.
How severe is CVE-2026-12598?: High severity, with a CVSS score of 8.1, published 10 July 2026.
Which products and versions are affected?: LoginPress Pro up to and including 6.2.3.
Is there a fix for CVE-2026-12598?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-12598 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-12598?: Check whether you run LoginPress Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The LoginPress Pro plugin for WordPress is vulnerable to an authentication bypass in the Spotify Social Login addon due to improper identity verification in the loginpress_on_spotify_login() function. The plugin retrieves the 'email' field from Spotify's /v1/me endpoint and uses it to identify and authenticate a WordPress user via get_user_by() without verifying that the email address has been validated by Spotify. Since Spotify allows unverified emails in user profiles, an unauthenticated attacker can register a Spotify account using a target's email address (such as an administrator's) and successfully log in to the WordPress site. The vulnerability is present in versions up to and including 6.2.3.

Affected products

LoginPress LoginPress Pro up to and including 6.2.3

Timeline

2026-07-10: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.