The MelaPress Login Security and MelaPress Login Security Premium plugins for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'monitor_admin_actions' function in version 2.1.0. This makes it possible for unauthenticated attackers to delete any user.
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
| Vendor | Product | Versions | |
|---|---|---|---|
| melapress | MelaPress Login Security | 2.1.0 | |
| melapress | MelaPress Login Security Premium | 2.1.0 |
cpe:2.3:a:melapress:melapress_login_security:*:*:*:*:free:wordpress:*:* < 2.1.1cpe:2.3:a:melapress:melapress_login_security:*:*:*:*:premium:wordpress:*:* < 2.1.1Our free, open-source honeypot sensor waits on ports your server does not use and reports the scanners and attackers that connect to a shared blocklist.