CVE-2025-6895 – Melapress WordPress Authentication Bypass Vulnerability

July 28, 2025

CVE ID : CVE-2025-6895

Published : July 26, 2025, 5:15 a.m. | 2 days, 18 hours ago

Description : The Melapress Login Security plugin for WordPress is vulnerable to Authentication Bypass due to missing authorization within the get_valid_user_based_on_token() function in versions 2.1.0 to 2.1.1. This makes it possible for unauthenticated attackers who know an arbitrary user meta value to bypass authentication checks and log in as that user.

Severity: 9.8 | CRITICAL

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

Source: Read More

Previous ArticleCVE-2025-8178 – Tenda AC10 Heap-Based Buffer Overflow Vulnerability

Next Article CVE-2025-54416 – GitHub tj-actions Branch Names Command Injection Vulnerability

Highlights

CVE-2025-2168 – Elementor Store Kit CSRF

May 1, 2025

CVE ID : CVE-2025-2168

Published : May 1, 2025, 4:16 a.m. | 3 hours, 55 minutes ago

Description : The Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.1. This is due to missing or incorrect nonce validation on the dismiss() function. This makes it possible for unauthenticated attackers to set arbitrary user meta values to `1` which can be leveraged to lock and administrator out of their site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Severity: 4.3 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

From Data To Decisions: UX Strategies For Real-Time Dashboards

Honeycomb launches AI observability suite for developers

Low-Code vs No-Code Platforms for Node.js: What CTOs Must Know Before Investing

ServiceNow unveils Zurich AI platform

DistroWatch Weekly, Issue 1139

Building personal apps with open source and AI

What Can We Actually Do With corner-shape?

Craft, Clarity, and Care: The Story and Work of Mengchu Yao

Optimizely Mission Control – Part III

Optimizely Mission Control – Part III

Learning from PHP Log to File Example

Online EMI Calculator using PHP – Calculate Loan EMI, Interest, and Amortization Schedule

DistroWatch Weekly, Issue 1139

DistroWatch Weekly, Issue 1139

sudo vs sudo-rs: What You Need to Know About the Rust Takeover of Classic Sudo Command

Dmitry — The Deep Magic

CVE-2025-6895 – Melapress WordPress Authentication Bypass Vulnerability

Cursor AI Code Editor Flaw Enables Silent Code Execution via Malicious Repositories

Introducing HybridPetya: Petya/NotPetya copycat with UEFI Secure Boot bypass

Microsoft Copilot’s own default configuration exposed users to the first-ever “zero-click” AI attack, but there was no data breach

CVE-2025-3974 – PHPGurukul COVID19 Testing Management System SQL Injection Vulnerability

From prompt to production: Building a landing page with Copilot agent mode

CVE-2025-46352 – “CS5000 Fire Panel Hard-Coded Password Remote Command Injection Vulnerability”

CVE-2025-2168 – Elementor Store Kit CSRF

CVE-2025-1625 – Qi Blocks WordPress Stored Cross-Site Scripting Vulnerability

Stream-Omni: Simultaneous Multimodal Interactions with Large Language-Vision-Speech Model

CVE-2025-4986 – “3DEXPERIENCE Product Manager Stored XSS”

CVE-2025-6895 – Melapress WordPress Authentication Bypass Vulnerability

Related Posts