The vulnerability in LoginPress Pro (<=6.2.3) arises from the loginpress_on_github_login() function trusting the first email in GitHub's /user/emails API response without checking if the email is verified. An attacker can add an unverified email address to their GitHub profile that matches a WordPress user email and trigger the OAuth callback with a crafted code parameter. Because the plugin uses get_user_by('email', ...) on this unverified email, it establishes an authenticated session for that user, bypassing authentication controls. Exploitation depends on GitHub returning the attacker-controlled unverified email at index 0, which is not typical but possible. The flaw is a fundamental improper authentication (CWE-287) issue.

Successful exploitation allows unauthenticated attackers to bypass authentication and log in as any WordPress user, including administrators. This leads to full compromise of the affected WordPress site, with confidentiality, integrity, and availability impacts rated high (CVSS 8.1).

No official patch or fix has been confirmed at this time. Users should monitor the vendor's advisory for updates. Until a fix is available, avoid enabling GitHub OAuth login or restrict its use. Review OAuth configurations and consider disabling LoginPress Pro's GitHub login feature if possible. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.