CVE-2026-12595 is an authentication bypass vulnerability in LoginPress Pro for WordPress affecting all versions up to and including 6.2.3. The vulnerability arises because the loginpress_on_discord_login() function accepts the email field from Discord's /users/@me endpoint without verifying the 'verified' flag on the email profile. It then maps this email directly to a local WordPress user account and issues an authenticated session cookie. This improper authentication check (CWE-287) enables unauthenticated attackers to take over any existing WordPress account by exploiting unverified Discord email addresses that match the target user's registered email.

Successful exploitation allows an unauthenticated attacker to bypass authentication and gain full access to any WordPress account, including administrator accounts. This compromises confidentiality, integrity, and availability of the affected WordPress site, potentially leading to complete site takeover.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling Discord OAuth login integration or restricting login methods to trusted authentication providers. Monitor vendor channels for updates and apply patches promptly when available.