MelaPress Login Security and MelaPress Login Security Premium Unauthorized User Deletion Vulnerability

A vulnerability allowing unauthorized deletion of users has been identified in the MelaPress Login Security and MelaPress Login Security Premium plugins for WordPress, specifically in version 2.1.0. This issue arises from a missing capability check in the 'monitor_admin_actions' function, which enables unauthenticated attackers to delete any user.

Impact

Exploitation of this vulnerability allows for unauthorized deletion of users.

Reproduction

The vulnerability can be reproduced by sending a request to the 'monitor_admin_actions' function without the necessary authorization. This can be done by an unauthenticated user, taking advantage of the missing capability check to delete a user.

Remediation

Users are advised to update to version 2.1.1 or a newer patched version.