Critical · published July 18, 2025
🚨 An unauthenticated attacker can slip in like a shadow, logging in as any user on a WordPress site using the LoginPress Pro plugin, including administrators! 🔥 Think of it like a restaurant where the host doesn't check reservation names — anyone could walk in and take a seat at the best table, including the owner, simply by knowing their name. This vulnerability could lead to unauthorized access to sensitive user accounts, allowing attackers to view confidential information or perform actions as if they were the logged-in user. Imagine a rogue actor accessing critical admin functions, potentially compromising the entire site. It's absolutely devastating!
Think of it like a restaurant where the host doesn't check reservation names — anyone could walk in and take a seat at the best table, including the owner, simply by knowing their name. The flaw arises from insufficient verification of the user linked to a social login token in the LoginPress Pro plugin for WordPress. Attackers can exploit this weakness to log in as any existing user if they have access to the associated email, bypassing standard authentication measures.
This vulnerability could lead to unauthorized access to sensitive user accounts, allowing attackers to view confidential information or perform actions as if they were the logged-in user. Imagine a rogue actor accessing critical admin functions, potentially compromising the entire site. It's absolutely devastating! Immediately update the LoginPress Pro plugin to version 5.0.2 or later to patch this vulnerability. Additionally, review your user accounts to ensure there are no unauthorized logins, and consider implementing further verification steps for social logins. Security is key! You've got this! Follow these steps to secure your site and keep those shadows at bay! 🛡️