CVE-2025-2876
MelaPress Login Security and MelaPress Login Security Premium 2.1.0 - Missing Authorization to Unauthenticated Arbitrary User Deletion
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
The MelaPress Login Security and MelaPress Login Security Premium plugins for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'monitor_admin_actions' function in version 2.1.0. This makes it possible for unauthenticated attackers to delete any user.
| CWE | CWE-862 |
| Vendor | melapress |
| Product | melapress login security premium |
| Published | Apr 8, 2025 |
| Last Updated | Apr 8, 2025 |
Stay Ahead of the Next One
Get instant alerts for melapress melapress login security premium
Be the first to know when new medium vulnerabilities affecting melapress melapress login security premium are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
melapress / MelaPress Login Security Premium
2.1.0
melapress / MelaPress Login Security
2.1.0
References
wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/559cbc69-85b6-4bad-9bb2-26d64195ba7e?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/melapress-login-security/trunk/app/modules/temporary-logins/class-temporary-logins.php#L71 melapress.com: https://melapress.com/wordpress-login-security/releases/ plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset/3267748/
Credits
Michelle Porter