WordPress Plugin Vulnerabilities

MelaPress Login Security 2.1.0 - 2.1.1 - Privilege Escalation via Authentication Bypass

Description

The plugin is vulnerable to Authentication Bypass due to missing authorization within the get_valid_user_based_on_token() function. This makes it possible for unauthenticated attackers who know an arbitrary user meta value to bypass authentication checks and log in as that user.

Affects Plugins

Plugin icon
melapress-login-security
Fixed in 2.2.0

References

CVE
CVE-2025-6895
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/6f65d5c4-6f53-4836-9130-c9f4ed3be893

Classification

Type
AUTHBYPASS
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-287
CVSS
9.8 (critical)

Miscellaneous

Original Researcher
kr0d
Verified
No
WPVDB ID
1de9116f-b651-4e85-b284-6a5ed49cd625

Timeline

Publicly Published
2025-07-25 (about 1 year ago)
Added
2025-07-28 (about 1 year ago)
Last Updated
2025-07-28 (about 1 year ago)

Other

Published
Title
Published
2026-07-06
Title
QRcode Login for WeChat <= 1.3 - Unauthenticated Account Takeover
Published
2015-03-04
Title
Dignitas 1.1.9 - Privilage Escalation
Published
2023-12-27
Title
Login as User or Customer (User Switching) <= 3.8 - Authentication Bypass
Published
2014-08-01
Title
Wordfence 3.8.1 - Password Creation Restriction Bypass
Published
2020-03-31
Title
Elementor Page Builder < 2.9.6 - Authenticated Safe Mode Privilege Escalation