Unauthorized Data Loss in MelaPress Login Security Plugins for WordPress
CVE-2025-2876

8.2HIGH

Key Information:

Vendor

WordPress
Status
Melapress Login Security Premium
Melapress Login Security
Vendor
CVE Published:
8 April 2025

What is CVE-2025-2876?

The MelaPress Login Security and MelaPress Login Security Premium plugins for WordPress contain a vulnerability that allows unauthorized users to exploit a missing capability check on the 'monitor_admin_actions' function. This oversight can lead to the deletion of any user from the system by unauthenticated attackers. Implementing proper access controls is essential to safeguard user data and maintain the integrity of the WordPress environment.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

MelaPress Login Security 2.1.0

MelaPress Login Security Premium 2.1.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/melapress-logi...
https://melapress.com/wordpress-login-security/releases/

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Michelle Porter
JSON
.