Authentication Bypass in LoginPress Pro Plugin for WordPress

CVE-2025-7444

What is CVE-2025-7444?

The LoginPress Pro plugin for WordPress presents a security flaw that allows unauthenticated attackers to bypass authentication mechanisms. This vulnerability arises from improper validation of the user identity during social login processes. By exploiting this weakness, an attacker can potentially impersonate any existing user on the site, including administrators, provided they have access to an email that is not already linked to an existing account for the service issuing the social login token. This vulnerability affects all versions of LoginPress Pro up to and including 5.0.1.

References