Quick answers
- Is CVE-2026-49058 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-49058 being exploited in the wild.
- How severe is CVE-2026-49058?
- Critical severity, with a CVSS score of 9.8, published 17 June 2026.
- Which products and versions are affected?
- LoginPress Pro <= 6.2.2.
- Is there a fix for CVE-2026-49058?
- A patch was published on 2026-06-17: Patch confirmed available in version 6.2.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-49058 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-49058?
- Check whether you run LoginPress Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A privilege escalation vulnerability exists in LoginPress Pro due to incorrect privilege assignment (CWE-266). The flaw allows an unauthenticated remote attacker to escalate their privileges, potentially gaining full administrative control over the affected WordPress installation. The attack can be executed over the network without any user interaction or prior authentication. The vulnerability is addressed in version 6.2.3.
Affected products
- LoginPress LoginPress Pro <= 6.2.2
Timeline
- 2026-05-31: other: Reported by researcher wackydawg
- 2026-06-08: disclosed: Initial disclosure by Patchstack
- 2026-06-17: advisory: CVE published and NVD record created
- 2026-06-17: patched: Patch confirmed available in version 6.2.3