LoginPress vulnerabilities
We track 4 vulnerabilities in LoginPress products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on July 10, 2026.
Latest LoginPress vulnerabilities
- 8.1 High severity
LoginPress Pro: Improper Authentication
The LoginPress Pro plugin for WordPress is vulnerable to authentication bypass in versions up to and including 6.2.3 via the Spotify Social Login addon. This is due to the loginpress_on_spotify_login() function trusting the unverified 'email' field returned by
- 8.1 High severity
LoginPress Pro: Improper Authentication
The LoginPress Pro plugin for WordPress is vulnerable to Authentication Bypass via the GitHub OAuth callback in versions up to, and including, 6.2.3. The vulnerability exists in the loginpress_on_github_login() function, which blindly trusts the first element
- 8.1 High severity
LoginPress Pro: Improper Authentication
The LoginPress Pro plugin for WordPress is vulnerable to Authentication Bypass via Unverified OAuth Email in all versions up to and including 6.2.3. The vulnerability exists in the loginpress_on_discord_login() Discord OAuth callback handler, which accepts the
- 9.8 Critical severity
LoginPress Pro: Authentication Bypass Using an Alternate Path or Channel
The LoginPress Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.0.1. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticate