Login Request a demo
Critical severity · published Jul 26, 2025
CVE-2025-6895
MelaPress Login Security 2.1.0 - 2.1.1 - Authentication Bypass to Privilege Escalation via get_valid_user_based_on_token Function
9.8
CVSS
0.8%
EPSS
No
On KEV
Description
The Melapress Login Security plugin for WordPress is vulnerable to Authentication Bypass due to missing authorization within the get_valid_user_based_on_token() function in versions 2.1.0 to 2.1.1. This makes it possible for unauthenticated attackers who know an arbitrary user meta value to bypass authentication checks and log in as that user.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ML
Melapress Login Security · melapress
2.1.0 through 2.1.1 · source: vendor
Affected product
ML
Melapress Login Security
melapress
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-6895
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-6895
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/melapress-login-security/tags/2.1.1/app/class-melapress-login-security.php
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/melapress-login-security/tags/2.1.1/app/modules/temporary-logins/class-temporary-logins.php
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset/3328137
wordpress.org
https://wordpress.org/plugins/melapress-login-security/#developers
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/6f65d5c4-6f53-4836-9130-c9f4ed3be893?source=cve
More from Melapress Login Security
8.2
CVE-2025-2876
MelaPress Login Security and MelaPress Login Security Premium 2.1.0 - Missing Authorization to Unauthenticated Arbitrary User Deletion
7.2
CVE-2025-39565
WordPress MelaPress Login Security plugin <= 2.1.0 - PHP Object Injection Vulnerability
7.2
CVE-2024-35650
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Melapress MelaPress Login Security…