CVE-2026-12597 is an authentication bypass vulnerability in the LoginPress Pro WordPress plugin affecting versions up to and including 6.2.3. The vulnerability arises because the loginpress_on_github_login() function blindly trusts the first email address returned by GitHub's /user/emails API without verifying that the email is marked as verified. An attacker can add an unverified email address to their GitHub profile that matches an existing WordPress user email and trigger the OAuth callback with a crafted code parameter. The plugin then calls get_user_by('email', ...) and establishes an authenticated session for that user, bypassing normal authentication controls. The flaw is due to missing verification of the email's verified status, a fundamental authentication weakness.

Successful exploitation allows unauthenticated attackers to log in as any existing WordPress user, including administrators, thereby gaining full control over the affected WordPress site. This compromises confidentiality, integrity, and availability of the site and its data. The attack depends on GitHub returning the attacker-added unverified email as the first element in the email array, which is not typical but possible. The vulnerability has a CVSS 3.1 score of 8.1 (high severity) reflecting network attack vector, high impact on confidentiality, integrity, and availability, and requires high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling GitHub OAuth login in LoginPress Pro or implementing additional verification controls on OAuth email addresses. Monitor vendor channels for updates and apply official patches promptly once released.