CVE-2025-6895: Login Security Plugin Auth Bypass Flaw

CVE-2025-6895 Overview

The Melapress Login Security plugin for WordPress contains a critical authentication bypass vulnerability in versions 2.1.0 to 2.1.1. The flaw exists within the get_valid_user_based_on_token() function, which fails to properly implement authorization checks. This vulnerability allows unauthenticated attackers who possess knowledge of an arbitrary user meta value to bypass authentication controls and log in as that user, potentially gaining full administrative access to WordPress installations.

Critical Impact

Unauthenticated attackers can bypass authentication and log in as any WordPress user, including administrators, if they know an arbitrary user meta value. This could lead to complete site takeover.

Affected Products

• Melapress Login Security WordPress Plugin version 2.1.0
• Melapress Login Security WordPress Plugin version 2.1.1
• WordPress sites utilizing affected plugin versions

Discovery Timeline

• 2025-07-26 - CVE-2025-6895 published to NVD
• 2025-07-29 - Last updated in NVD database

Technical Details for CVE-2025-6895

Vulnerability Analysis

This vulnerability is classified under CWE-288 (Authentication Bypass Using an Alternate Path or Channel). The core issue resides in the temporary logins functionality of the Melapress Login Security plugin. The get_valid_user_based_on_token() function, found within the temporary logins module, lacks proper authorization validation when processing authentication tokens.

The vulnerability stems from the plugin's failure to adequately verify that the token being used for authentication is legitimately associated with the requesting user. By exploiting this flaw, an attacker can craft requests that leverage knowledge of user meta values to authenticate as arbitrary users without providing valid credentials.

Root Cause

The root cause is missing authorization checks within the get_valid_user_based_on_token() function in the class-temporary-logins.php module. The function processes user tokens without sufficiently validating that the requester has legitimate access rights to use those tokens. This allows attackers to bypass the normal authentication flow by manipulating token-based authentication requests. The vulnerable code path can be examined in the WordPress Plugin Module File.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker with knowledge of user meta values (which can potentially be obtained through information disclosure vulnerabilities, plugin database leaks, or other reconnaissance techniques) can send crafted requests to the WordPress site to exploit the authentication bypass.

The exploitation process involves targeting the temporary login functionality where the flawed token validation occurs. Since the vulnerability requires no privileges and can be exploited remotely, it presents a significant risk to any WordPress site running the affected plugin versions.

Technical details about the vulnerability and the code changes can be reviewed in the WordPress Changeset Details and the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-6895

Indicators of Compromise

• Unexpected login events for administrative or privileged user accounts without corresponding legitimate activity
• Authentication logs showing successful logins from unusual IP addresses or geographic locations
• User session creation events without matching credential verification attempts
• Anomalous requests targeting temporary login endpoints with non-standard token parameters

Detection Strategies

• Monitor WordPress authentication logs for successful logins that lack preceding failed attempts or credential checks
• Implement Web Application Firewall (WAF) rules to detect and block suspicious token-based authentication requests
• Deploy endpoint detection to identify unauthorized session creation on WordPress installations
• Review access logs for requests targeting /wp-content/plugins/melapress-login-security/ endpoints with unusual parameters

Monitoring Recommendations

• Enable detailed WordPress authentication logging including source IP, user agent, and timestamp correlation
• Configure alerting for administrative account logins from new or untrusted IP addresses
• Monitor plugin-related PHP execution for calls to get_valid_user_based_on_token() and related functions
• Implement SIEM rules to correlate authentication events with network traffic anomalies

How to Mitigate CVE-2025-6895

Immediate Actions Required

• Update Melapress Login Security plugin to the latest patched version immediately
• Audit all WordPress user accounts for unauthorized access or suspicious activity
• Review and reset credentials for all administrative accounts if compromise is suspected
• Temporarily disable the plugin if immediate update is not possible

Patch Information

The vulnerability affects Melapress Login Security versions 2.1.0 to 2.1.1. A security patch addressing this authentication bypass has been released. Administrators should update to the latest version available through the WordPress plugin repository. The fix details can be reviewed in the WordPress Changeset Details and update information is available on the WordPress Plugin Developer Info page.

Workarounds

• Disable the Melapress Login Security plugin until a patched version can be installed
• Implement Web Application Firewall rules to block unauthenticated requests to temporary login endpoints
• Restrict access to WordPress admin areas by IP address using server-level configurations
• Enable two-factor authentication for all administrative accounts as an additional security layer

# Example: Restrict plugin access via .htaccess (temporary mitigation)
# Add to WordPress root .htaccess file
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/wp-content/plugins/melapress-login-security/ [NC]
RewriteCond %{REMOTE_ADDR} !^192\.168\.1\. [NC]
RewriteRule .* - [F,L]
</IfModule>