CVEvulnerability
CVE-2025-6895
9.8 CRITICAL
Official page ↗
- Status
- Deferred
- Published
- 2025-07-26
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-288
Description
The Melapress Login Security plugin for WordPress is vulnerable to Authentication Bypass due to missing authorization within the get_valid_user_based_on_token() function in versions 2.1.0 to 2.1.1. This makes it possible for unauthenticated attackers who know an arbitrary user meta value to bypass authentication checks and log in as that user.
Related
Weakness · CWE (1)
- CWE-288 Authentication Bypass Using an Alternate Path or Channel weakness
References
- https://plugins.trac.wordpress.org/browser/melapress-login-security/tags/2.1.1/app/class-melapress-login-security.php plugins.trac.wordpress.org
- https://plugins.trac.wordpress.org/browser/melapress-login-security/tags/2.1.1/app/modules/temporary-logins/class-temporary-logins.php plugins.trac.wordpress.org
- https://plugins.trac.wordpress.org/changeset/3328137 plugins.trac.wordpress.org
- https://wordpress.org/plugins/melapress-login-security/#developers wordpress.org
- https://www.wordfence.com/threat-intel/vulnerabilities/id/6f65d5c4-6f53-4836-9130-c9f4ed3be893?source=cve www.wordfence.com