CVE-2026-49058: WordPress LoginPress Pro plugin <= 6.2.2 - Privilege Escalation vulnerability

Synopsis

An unauthenticated privilege escalation vulnerability affects the WordPress LoginPress Pro plugin at version 6.2.2 and earlier. The flaw is reachable over the network with no credentials required and no user interaction needed, making it trivially exploitable by any remote attacker who can reach the WordPress instance. Successful exploitation allows an attacker to escalate to a privileged role, gaining full read, write, and availability impact over the affected site. No upstream fix has been published yet; HarborGuard tracks the advisory and will make a patched-image rebuild available the moment a fix version is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, so an attacker must be able to send HTTP requests to the WordPress instance.

• AuthenticationNot required

  No account or session token is needed; the privilege escalation path is fully accessible to unauthenticated remote requests.

• Victim interactionNot required

  The attacker does not need any site user or administrator to take any action; exploitation is entirely attacker-driven.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race conditions, or environmental prerequisites.

Blast Radius

• An attacker gains a privileged WordPress role, reading all stored content, user records, credentials, and private data held in the database.
• With write access, an attacker can modify or delete posts, pages, plugin settings, and user accounts, including creating new administrator accounts.
• Full integrity impact means an attacker can install or modify WordPress plugins and themes, enabling persistent backdoors or malicious code injection.
• Full availability impact means an attacker can disable the site, corrupt database content, or lock out legitimate administrators entirely.