Introduction
Unauthorized user deletions and privilege escalation on a WordPress site can cause immediate loss of access and data integrity. Versions 2.1.0 to 2.1.1 of the Melapress Login Security plugin, a popular choice for strengthening WordPress authentication, contain a critical authentication bypass tracked as CVE-2025-6895. An attacker who exploits it can bypass authentication and perform privileged operations, including arbitrary user deletion, without valid credentials.
Melapress develops security-focused plugins for WordPress, including tools for two-factor authentication, role management, and audit logging. Its products are widely used across the WordPress ecosystem, so a vulnerability in one of its plugins has a wide impact on site administrators and service providers.
Technical information
CVE-2025-6895 comes from a missing authorization check in the get_valid_user_based_on_token function, which validates temporary login tokens. In plugin versions 2.1.0 and 2.1.1, this function does not properly enforce authorization, so an attacker can craft requests with arbitrary user meta values (such as a user ID or email) to bypass authentication controls. If the attacker knows or can guess a valid user meta value, they can log in as any user, including an administrator.
A second flaw, a missing capability check in the monitor_admin_actions function, lets unauthenticated attackers delete arbitrary users. The function is meant to track administrative actions, but in the vulnerable versions it does not verify user permissions before it runs sensitive operations.
Both flaws share a root cause. Critical user management functions lack proper authorization and capability checks, which leaves the site open to privilege escalation and user deletion attacks.
Proof of concept
Version 2.1.0 of the MelaPress Login Security and MelaPress Login Security Premium plugins for WordPress has a critical vulnerability caused by a missing capability check in the 'monitor_admin_actions' function. Unauthenticated attackers can use it to delete any user from the WordPress installation.
The 'monitor_admin_actions' function is designed to track administrative actions in the WordPress dashboard. In the affected version, it does not check whether a user has the necessary permissions before it executes certain actions. An attacker can send a specially crafted request to the site that reaches this function, bypasses authentication, and triggers deletion of arbitrary user accounts. That could cause unauthorized data loss and disrupt site operations.
The vulnerability is fixed in version 2.1.1 of the plugins. Users are strongly advised to update to the latest version.
PoC source: Wordfence Advisory
Patch information
The development team released version 2.1.1 of the MelaPress Login Security plugin in response. It adds a capability check to the monitor_admin_actions function that verifies the user has the appropriate permissions before the function runs administrative tasks. Only authorized users can now perform those sensitive operations, which blocks unauthenticated attackers from deleting users.
Users are strongly advised to update the MelaPress Login Security plugin to version 2.1.1 or later.
Patch sources:
Detection methods
To detect unauthorized user deletions caused by the missing authorization vulnerability in MelaPress Login Security 2.1.0, monitor for specific indicators of compromise (IoCs) and set up targeted logging and alerting. (secalerts.co)
Indicators of compromise
- Review WordPress audit logs for user deletions, especially ones initiated by non-administrative accounts or from IP addresses not associated with administrative activity.
- Watch user activity logs for deletion patterns that differ from normal administrative behavior, such as multiple deletions in a short timeframe or deletions during off-hours.
Log analysis and monitoring
- Configure WordPress and server logs to record detailed information about user management actions, including the initiator's IP address, user agent, and the exact time of the action.
- Store logs securely and make them tamper-evident, so they stay reliable as a source of truth.
- Set alerts that trigger when user deletions exceed a predefined threshold within a specific period.
- Use anomaly detection to identify deviations from established patterns of user management activity.
Network traffic monitoring
- Watch network traffic for unusual or unexpected calls to WordPress REST API endpoints related to user management, especially calls from unrecognized IP addresses.
- Rate-limit sensitive API endpoints to reduce the risk of automated attacks.
File integrity monitoring
- Use file integrity monitoring tools to detect unauthorized changes to the MelaPress Login Security plugin files, which could indicate exploitation attempts.
- Regularly verify the checksums of critical files against known good values to detect tampering.
User behavior analytics
- Build baselines for typical administrative behavior around user management.
- Alert when actions deviate significantly from those baselines, such as an administrator account deleting users from an unfamiliar location or device.
Detection sources:
Affected systems and versions
- Product: Melapress Login Security plugin for WordPress
- Vulnerable versions: 2.1.0 and 2.1.1
- Configuration: Any WordPress installation using the above plugin versions is vulnerable, regardless of other configuration settings.
Vendor security history
Melapress has previously fixed vulnerabilities involving missing authorization checks and privilege escalation in its plugins. The vendor has a track record of releasing timely patches and practicing responsible disclosure. Repeated problems with authorization logic, though, show a need for ongoing code review and security testing in its development lifecycle.
