CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The Melapress Login Security plugin for WordPress is vulnerable to Authentication Bypass due to missing authorization within the get_valid_user_based_on_token() function in versions 2.1.0 to 2.1.1. This makes it possible for unauthenticated attackers who know an arbitrary user meta value to bypass authentication checks and log in as that user.
Explanation of Vulnerability in Simple Terms
Melapress Login Security versions 2.1.0 and 2.1.1 contain an authentication bypass vulnerability. An attacker can gain unauthorized access to the site without valid credentials. The vulnerability requires no user interaction and can be exploited remotely over the network. Site administrators should update immediately to a version newer than 2.1.1.
What an attacker can do
Bypass authentication and gain unauthorized access to the site without valid credentials.
Potential impact on your site
Attackers can access your site without a valid account, potentially compromising all user data and site functionality.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
