LoginPress Pro

LoginPress Pro has 7 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; all 7 are fixed as of September 2026. Their average CVSS score is 7.8, and the most serious one scores 9.8 out of 10. Severity breakdown: 2 critical and 3 high. 2026 was the busiest year with 4 disclosures.

The most common weakness is Improper Authentication, behind 3 of the records (43%). Other recurring categories include Authentication Bypass Using An Alternate Path Or Channel, Guessable CAPTCHA.

Every one of the 7 issues recorded for LoginPress Pro has a vendor fix available, so running the current release closes all known holes.

4 independent researchers contributed these findings, most of them (3) reported by Nguyen Ngoc Duc (duc193).

Strategic Overview

Avg CVSSHigh

7.8/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all LoginPress Pro vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2026-49058

LoginPress Pro <= 6.2.2 - Unauthenticated Privilege Escalation

Read the full analysis

Vulnerability Records

7 records


2026-07-09 11:14	LoginPress Pro <= 6.2.3 - Unauthenticated Authentication Bypass via Unverified OAuth Email via GitHub OAuth Callback LoginPress Pro <= 6.2.3	`CVE-2026-12597`	8.1 High	Nguyen Ngoc Duc (duc193)	Yes
2026-07-09 11:14	LoginPress Pro <= 6.2.3 - Unauthenticated Authentication Bypass via Unverified OAuth Email via Discord OAuth Callback LoginPress Pro <= 6.2.3	`CVE-2026-12595`	8.1 High	Nguyen Ngoc Duc (duc193)	Yes
2026-07-09 11:13	LoginPress Pro <= 6.2.3 - Unauthenticated Authentication Bypass via Unverified OAuth Email in Spotify OAuth Callback LoginPress Pro <= 6.2.3	`CVE-2026-12598`	8.1 High	Nguyen Ngoc Duc (duc193)	Yes
2026-06-08 00:00	LoginPress Pro <= 6.2.2 - Unauthenticated Privilege Escalation LoginPress Pro <= 6.2.2	`CVE-2026-49058`	9.8 Critical	wackydawg	Yes
2025-07-17 00:00	LoginPress Pro <= 5.0.1 - Authentication Bypass via WordPress.com OAuth provider LoginPress Pro <= 5.0.1	`CVE-2025-7444`	9.8 Critical	Foxyyy	Yes
2024-04-17 00:00	LoginPress Pro < 3.0 - Missing Authorization to License Status Update LoginPress Pro < 3.0	`CVE-2024-32677`	5.3 Medium	Dave Jong	Yes
2024-04-17 00:00	LoginPress Pro < 3.0 - Captcha Bypass LoginPress Pro < 3.0	`CVE-2024-32676`	5.3 Medium	Dave Jong	Yes

Showing 1–7 of 7 reports