CVE-2025-6895

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The Melapress Login Security plugin for WordPress is vulnerable to Authentication Bypass due to missing authorization within the get_valid_user_based_on_token() function in versions 2.1.0 to 2.1.1. This makes it possible for unauthenticated attackers who know an arbitrary user meta value to bypass authentication checks and log in as that user.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-288

Affected software

No affected versions have been published.

Timeline

Published: Jul 26, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-689506.2ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, Magick fails to ch CVE-2025-689516.1phpMyFAQ is an open source FAQ web application. Versions 4.0.14 and 4.0.15 have a stored cross-site scripting (XSS) vulnerability that allow CVE-2025-689529.8Eigent is a multi-agent Workforce. In version 0.0.60, a 1-click Remote Code Execution (RCE) vulnerability has been identified in Eigent. Thi CVE-2025-689537.5Frappe is a full-stack web application framework. Versions 14.99.5 and below and 15.0.0 through 15.80.1 include requests that are vulnerable CVE-2025-689545.4Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below do not revoke active SFTP connections when a use CVE-2025-689554.7Multi-thread race condition vulnerability in the card framework module. Impact: Successful exploitation of this vulnerability may affect av CVE-2025-689564.7Multi-thread race condition vulnerability in the card framework module. Impact: Successful exploitation of this vulnerability may affect ava CVE-2025-689574.7Multi-thread race condition vulnerability in the card framework module. Impact: Successful exploitation of this vulnerability may affect ava CVE-2025-689584.7Multi-thread race condition vulnerability in the card framework module. Impact: Successful exploitation of this vulnerability may affect ava CVE-2025-689595.5Permission verification bypass vulnerability in the media library module. Impact: Successful exploitation of this vulnerability may affect s CVE-2025-68968.8A vulnerability classified as critical has been found in D-Link DI-7300G+ 19.12.25A1. Affected is an unknown function of the file wget_test.CVE-2025-689604.7Multi-thread race condition vulnerability in the video framework module. Impact: Successful exploitation of this vulnerability may affect av