CVE-2025-7444: 
WordPress vulnerability analysis and mitigation

CVE-2025-7444 affects the LoginPress Pro plugin for WordPress in versions up to and including 5.0.1. The vulnerability was discovered and disclosed on July 18, 2025, and involves an authentication bypass vulnerability in the WordPress.com OAuth provider functionality (NVD).

The vulnerability stems from insufficient verification of the user being returned by the social login token. This authentication bypass vulnerability is classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel). The severity is rated as CRITICAL with a CVSS v3.1 base score of 9.8 (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) (NVD).

The vulnerability allows unauthenticated attackers to log in as any existing user on the site, including administrators, if they have access to the email and the user does not have an already-existing account for the service returning the token (NVD).

The vulnerability has been patched in LoginPress Pro version 5.0.2, released on July 17, 2025. Users are strongly advised to update to this version which includes an important security update addressing the WordPress.com authentication vulnerability (LoginPress Changelog).