The Melapress MelaPress Login Security plugin suffers from a deserialization of untrusted data vulnerability (CVE-2025-39565) that permits object injection attacks. This issue affects all versions up to 2.1.0. Exploitation could result in complete compromise of confidentiality, integrity, and availability of the affected system. The CVSS vector indicates network attack vector, high attack complexity, high privileges required, no user interaction, and unchanged scope. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability could allow an attacker with high privileges to execute arbitrary code or manipulate application logic via crafted serialized objects. This can lead to full compromise of the affected system's confidentiality, integrity, and availability. However, exploitation complexity is high and requires privileged access, limiting the attack surface. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and monitor for suspicious activity. Avoid using vulnerable versions of MelaPress Login Security if possible.