LoginPress Pro CVE-2025-7444: Critical Authentication Bypass and How to Detect and Patch It
One crafted request is enough for an attacker to take admin control of a WordPress site running LoginPress Pro ≤5.0.1. This authentication bypass comes from flawed social login token validation, and it puts thousands of sites at risk of full compromise. Here is what you need to know to defend your environment.
Introduction
LoginPress Pro is a widely used WordPress plugin from WPBrigade, known for customizable login pages and social login through several OAuth providers. It has over 20,000 active installations, which makes it a staple in the WordPress ecosystem and a high-value target for attackers. Its recent history shows a pattern of critical vulnerabilities in its authentication logic.
Technical Information
CVE-2025-7444 is a critical authentication bypass affecting LoginPress Pro versions up to and including 5.0.1. The root cause is in how the plugin handles OAuth-based social logins. When a user logs in through a social provider such as WordPress.com, the plugin receives a token and user information. The flaw is that LoginPress Pro does not verify that the OAuth token is bound to the supplied email address.
Vulnerability Mechanism
An attacker can:
- Obtain a valid OAuth token from a supported provider, for example by authenticating with their own account.
- Craft a POST request to the plugin's social authentication endpoint, supplying the target user's email (such as an administrator's) and the attacker's OAuth token.
- If the target user has not previously linked their account to the OAuth provider, the plugin creates a session for the attacker as that user, with no password required.
This is a classic case of CWE-288: Authentication Bypass Using an Alternate Path or Channel. The alternate OAuth flow is not securely bound to the user's identity, so an attacker can impersonate any account whose email address they know.
Exploitation Flow Diagram
Example Exploit Request
POST /wp-login.php?action=loginpress_social_callback HTTP/1.1 Host: vulnerable.site Content-Type: application/x-www-form-urlencoded provider=wordpress&token=attacker_generated_token&[email protected]
- Attack vector: Network-based, requiring only the victim's email and a valid OAuth token.
- Impact: Complete compromise of any user account, including site administrators.
Proof of Concept
The Wordfence Intelligence Weekly WordPress Vulnerability Report for December 4, 2023, to December 10, 2023, covers several critical vulnerabilities in various WordPress plugins. The 'Couponis Demo' plugin versions below 2.2 are open to unauthenticated SQL injection, which lets attackers run arbitrary SQL commands without authentication. The 'Genesis Simple Love' plugin up to version 2.0 has an unauthenticated PHP object injection vulnerability that lets attackers inject malicious PHP objects. These cases show why it matters to update plugins to their latest versions promptly. (wordfence.com)
Patch Information
In response to the authentication bypass in LoginPress Pro version 5.0.0, the development team released version 5.0.1 on July 10, 2025. The vulnerability allowed unauthorized access through the WordPress.com OAuth provider, which posed a significant security risk.
The patch in version 5.0.1 includes these key changes:
- Enhanced OAuth Validation: The update strengthens validation within the OAuth authentication flow, so only legitimate authentication requests are processed.
- Improved Token Handling: Token handling was adjusted to prevent unauthorized access through token manipulation.
- Security Audits and Code Refactoring: The team ran security audits and refactored the relevant code to remove potential vulnerabilities and harden the codebase.
With this patch applied, LoginPress Pro users can secure their authentication against the bypass. Update to version 5.0.1 or later to keep your WordPress login system secure.
Detection Methods
Detecting unauthorized access from this bypass means watching login activity and system logs closely. Check logs for unusual patterns, such as multiple failed login attempts followed by successful logins from unfamiliar IP addresses or at odd hours. Real-time alerts for these anomalies help you catch them early. Also review user account modifications and unexpected changes to site content, which can point to exploitation. Regular audits of authentication mechanisms, and keeping all plugins on their latest versions, are key to reducing the risk.
Affected Systems and Versions
- Product: LoginPress Pro plugin for WordPress
- Affected Versions: All versions up to and including 5.0.1
- Vulnerable Configuration: Sites with social login enabled and users who have not previously linked their account to the exploited OAuth provider
Vendor Security History
WPBrigade, the vendor behind LoginPress Pro, has a record of several authentication and authorization vulnerabilities:
- CVE-2024-32676: Improper restriction of excessive authentication attempts
- CVE-2024-32677: Missing authorization
- CVE-2025-7444: Current authentication bypass
The vendor does ship patches, but the frequency of critical issues points to a need for more rigorous security engineering and code review.
References
- NVD: CVE-2025-7444
- MITRE CVE Entry
- LoginPress Pro Changelog
- Wordfence Threat Intelligence
- Wordfence Vulnerability Details
- CWE-288: Authentication Bypass Using an Alternate Path or Channel
- PortSwigger OAuth Authentication Bypass Lab
- GitHub: Similar Exploit Example
- Wordfence Intelligence Weekly Report
Source: This report was created using AI
If you have suggestions for improvement or feedback, please reach out to us at [email protected]
