The Melapress Login Security plugin for WordPress is vulnerable to Authentication Bypass due to

链接： https://github.com/advisories/GHSA-rgqx-f26c-5v58

CVSS 评分： 9.8

参考链接：

• https://nvd.nist.gov/vuln/detail/CVE-2025-6895

• https://plugins.trac.wordpress.org/browser/melapress-login-security/tags/2.1.1/app/class-melapress-login-security.php

• https://plugins.trac.wordpress.org/browser/melapress-login-security/tags/2.1.1/app/modules/temporary-logins/class-temporary-logins.php

• https://plugins.trac.wordpress.org/changeset/3328137

• https://wordpress.org/plugins/melapress-login-security/#developers

• https://www.wordfence.com/threat-intel/vulnerabilities/id/6f65d5c4-6f53-4836-9130-c9f4ed3be893?source=cve

• https://github.com/advisories/GHSA-rgqx-f26c-5v58

描述：

The Melapress Login Security plugin for WordPress is vulnerable to Authentication Bypass due to missing authorization within the get_valid_user_based_on_token() function in versions 2.1.0 to 2.1.1. This makes it possible for unauthenticated attackers who know an arbitrary user meta value to bypass authentication checks and log in as that user.