9.8
Critical
CVE-2025-6895 The Melapress Login Security plugin for WordPress is vulnerable to Authentication Bypass due to missing authorization…
Description
The Melapress Login Security plugin for WordPress is vulnerable to Authentication Bypass due to missing authorization within the get_valid_user_based_on_token() function in versions 2.1.0 to 2.1.1. This makes it possible for unauthenticated attackers who know an arbitrary user meta value to bypass authentication checks and log in as that user.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| MelaPress Login Security 2.1 | 2.1.0 → 2.1.1 | No fix stated |
Other CVEs of MelaPress Login Security
The 4 CVEs of MelaPress Login Security →
CVE-2025-39565
Deserialization of Untrusted Data vulnerability in Melapress MelaPress Login Security melapress-login-security allows…
6.6
Medium
CVE-2025-2876
The MelaPress Login Security and MelaPress Login Security Premium plugins for WordPress is vulnerable to unauthorized…
5.3
Medium
CVE-2024-35650
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in…
4.9
Medium