LoginPress Pro Authentication Bypass Vulnerability

A vulnerability allowing authentication bypass has been identified in the LoginPress Pro plugin for WordPress, affecting all versions through 5.0.1. The issue arises from inadequate verification of users associated with social login tokens, enabling unauthenticated attackers to log in as any existing user, including administrators. This exploitation is possible if the attacker knows the user's email and the user lacks an existing account with the service providing the token.

Impact

Exploitation of this vulnerability allows for unauthorized access to user accounts, potentially including administrative accounts, depending on the targeted user.

Remediation

Users are advised to update to LoginPress Pro version 5.0.2 or a newer patched version.