Critical · published July 26, 2025
🚨 An authentication bypass in the Melapress Login Security plugin for WordPress is like leaving a back door open—anyone who knows an arbitrary user meta value can just waltz right in! 🔥 Think of this vulnerability like a restaurant that forgot to check IDs at the door. If someone knows the name of a VIP guest, they can simply saunter in and help themselves to their table, leaving the real guest outside wondering what happened! With this vulnerability, unauthenticated attackers can bypass security measures and log in as any user they wish. This could lead to unauthorized access to sensitive information, making it absolutely devastating for personal data and site integrity.
Think of this vulnerability like a restaurant that forgot to check IDs at the door. If someone knows the name of a VIP guest, they can simply saunter in and help themselves to their table, leaving the real guest outside wondering what happened! The flaw lies in the Melapress plugin's get_valid_user_based_on_token() function, which lacks proper authorization checks, allowing attackers to exploit known user meta values to log in without authentication.
With this vulnerability, unauthenticated attackers can bypass security measures and log in as any user they wish. This could lead to unauthorized access to sensitive information, making it absolutely devastating for personal data and site integrity. Immediate action is crucial: Update the Melapress Login Security plugin to version 2.1.2 or later to close this security hole. Additionally, review user permissions and implement stricter access controls to strengthen your site’s defenses. You've got this! By taking these steps, you'll not only secure your site but also earn your security hero badge! 🛡️