9.8
Critique
CVE-2025-6895 The Melapress Login Security plugin for WordPress is vulnerable to Authentication Bypass due to missing authorization…
Description
The Melapress Login Security plugin for WordPress is vulnerable to Authentication Bypass due to missing authorization within the get_valid_user_based_on_token() function in versions 2.1.0 to 2.1.1. This makes it possible for unauthenticated attackers who know an arbitrary user meta value to bypass authentication checks and log in as that user.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| MelaPress Login Security 2.1 | 2.1.0 → 2.1.1 | Pas de correctif indiqué |
Autres CVE de MelaPress Login Security
Les 4 CVE de MelaPress Login Security →
CVE-2025-39565
Deserialization of Untrusted Data vulnerability in Melapress MelaPress Login Security melapress-login-security allows…
6.6
Moyenne
CVE-2025-2876
The MelaPress Login Security and MelaPress Login Security Premium plugins for WordPress is vulnerable to unauthorized…
5.3
Moyenne
CVE-2024-35650
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in…
4.9
Moyenne