Unauthorized Data Loss in MelaPress Login Security Plugins for WordPress
CVE-2025-2876
5.3MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 8 April 2025
What is CVE-2025-2876?
The MelaPress Login Security and MelaPress Login Security Premium plugins for WordPress contain a vulnerability that allows unauthorized users to exploit a missing capability check on the 'monitor_admin_actions' function. This oversight can lead to the deletion of any user from the system by unauthenticated attackers. Implementing proper access controls is essential to safeguard user data and maintain the integrity of the WordPress environment.
Affected Version(s)
MelaPress Login Security 2.1.0
MelaPress Login Security Premium 2.1.0