CVE-2025-2876: Melapress Login Security Auth Bypass Flaw

CVE-2025-2876 Overview

CVE-2025-2876 affects the MelaPress Login Security and MelaPress Login Security Premium plugins for WordPress through version 2.1.0. The vulnerability stems from a missing capability check on the monitor_admin_actions function. Unauthenticated attackers can invoke this function over the network to delete arbitrary WordPress user accounts, including administrators.

The flaw is classified as Missing Authorization [CWE-862]. It requires no authentication, no user interaction, and minimal attack complexity, making any exposed WordPress site running the affected versions a viable target.

Critical Impact
Unauthenticated attackers can delete any user account in WordPress installations running MelaPress Login Security 2.1.0, including site administrators, resulting in loss of site control and integrity.

Affected Products

MelaPress Login Security (free) plugin for WordPress, versions up to and including 2.1.0
MelaPress Login Security Premium plugin for WordPress, versions up to and including 2.1.0
WordPress sites with the vulnerable plugin enabled and reachable over the network

Discovery Timeline

2025-04-08 - CVE-2025-2876 published to the National Vulnerability Database (NVD)
2025-07-17 - Last updated in NVD database

Technical Details for CVE-2025-2876

Vulnerability Analysis

The vulnerability resides in the monitor_admin_actions function within the MelaPress Login Security plugin's temporary logins module. The function performs administrative actions, including user deletion, without verifying that the caller has the required WordPress capability such as delete_users or manage_options.

Because WordPress dispatches AJAX actions via admin-ajax.php to both authenticated and unauthenticated handlers, an action hook registered without an authorization check is reachable by any anonymous HTTP client. Attackers can submit a crafted request specifying a target user identifier and trigger account deletion server-side.

The impact concentrates on integrity and availability rather than confidentiality. Removing the primary administrator account locks legitimate operators out of wp-admin, while mass deletion of subscribers, customers, or editors destroys site data and downstream records linked to user IDs.

Root Cause

The root cause is a missing current_user_can() capability check and absent nonce validation in the monitor_admin_actions handler. The handler trusts request parameters and proceeds to execute privileged operations without confirming the requester's identity or authorization.

Attack Vector

The attack vector is network-based. An attacker sends an HTTP POST request to the plugin's exposed AJAX endpoint with parameters identifying the action and the target user ID. No session, cookie, or token is required. See the upstream code reference at WordPress Temporary Logins Code and the Wordfence Vulnerability Analysis for additional context.

Detection Methods for CVE-2025-2876

Indicators of Compromise

Unexpected entries in WordPress logs showing user deletion events with no corresponding administrator session
Missing user accounts, particularly administrator or editor accounts, with no audit trail in the admin activity log
HTTP POST requests to /wp-admin/admin-ajax.php referencing MelaPress Login Security actions originating from unauthenticated clients
Sudden inability of administrators to log in due to account removal

Detection Strategies

Inspect web server access logs for POST requests to admin-ajax.php containing action parameters tied to the MelaPress monitor_admin_actions handler without an authenticated wordpress_logged_in_* cookie
Correlate WordPress users table changes with authentication logs to identify deletions occurring without a preceding admin login
Deploy WordPress Application Firewall (WAF) rules that block unauthenticated invocations of plugin AJAX actions performing privileged operations

Monitoring Recommendations

Enable WordPress activity logging and forward events to a centralized log platform for retention and alerting
Alert on any delete_user event that lacks an authenticated administrator context in the same request flow
Monitor the installed plugin inventory across WordPress fleets to surface sites still running MelaPress Login Security versions at or below 2.1.0

How to Mitigate CVE-2025-2876

Immediate Actions Required

Update MelaPress Login Security and MelaPress Login Security Premium to the patched release available via the MelaPress Login Security Releases page
Audit WordPress user accounts to confirm no unauthorized deletions have occurred and restore from backup if needed
Rotate administrator credentials and review installed plugins for other unauthenticated AJAX handlers

Patch Information

The vendor addressed the missing capability check in the source tree referenced by WordPress Changeset #3267748. The fix adds authorization validation to the monitor_admin_actions function so that only users with appropriate capabilities can trigger administrative operations. Site operators should upgrade to the version published immediately after this changeset.

Workarounds

Disable and remove the MelaPress Login Security plugin until the patched version can be deployed
Restrict access to /wp-admin/admin-ajax.php at the WAF or reverse proxy layer for requests that do not present a valid authenticated session cookie
Apply IP allow-listing to wp-admin endpoints where feasible to reduce exposure of the vulnerable handler

bash

# Example WAF rule (ModSecurity) blocking unauthenticated MelaPress AJAX actions
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1002876,msg:'Block MelaPress monitor_admin_actions when unauthenticated'"
SecRule ARGS:action "@rx ^(mls_|melapress_).*monitor_admin_actions" "chain"
SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"