PT-2025-30957 · WordPress · Melapress Login Security

Kenneth Dunn · Published 2025-07-26 · Updated 2025-07-26 · CVE-2025-6895

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Melapress Login Security versions 2.1.0 through 2.1.1

Description The Melapress Login Security plugin for WordPress is susceptible to authentication bypass due to missing authorization within the get valid user based on token() function. This allows unauthenticated attackers with knowledge of an arbitrary user meta value to bypass authentication checks and log in as that user.

Recommendations Update Melapress Login Security to a version later than 2.1.1.

Fix

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2025-6895

Affected Products

Melapress Login Security

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-6895 · Security Note
• https://twitter.com/CVEnew/status/1948976639028711592 · Twitter Post
• https://twitter.com/CveFindCom/status/1948974257058267178 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3328137 · Note
• https://wordpress.org/plugins/melapress-login-security/#developers · Note
• https://plugins.trac.wordpress.org/browser/melapress-login-security/tags/2.1.1/app/class-melapress-login-security.php · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/6f65d5c4-6f53-4836-9130-c9f4ed3be893?source=cve · Note
• https://plugins.trac.wordpress.org/browser/melapress-login-security/tags/2.1.1/app/modules/temporary-logins/class-temporary-logins.php · Note
• https://twitter.com/VulmonFeeds/status/1949038444547604597 · Twitter Post