Melapress Login Security changelog

This is the plugin’s changelog, which is mainly a detailed list of all the plugin changes and bug fixes introduced in every version update. Refer to the plugin release notes for a high level overview of what is new and improved with every plugin version update.

2.3.0 (2026-01-26)

New features

• Added a new feature to manually lock users and prevent them from logging in.
• Added a new setting in the Temporary logins setting to exclude temp users from 2FA enforcement.
• Implemented a custom plugin deactivation form to assist with user feedback collection.
• Implemented a new setting that allows admins to control the number of password reset emails sent on login attempts to user with expired passwords.

Plugin improvements

• Added a new feature to manually lock users and prevent them from logging in.
• Added a new setting in the Temporary logins setting to exclude temp users from 2FA enforcement.
• Implemented a custom plugin deactivation form to assist with user feedback collection.
• Implemented a new setting that allows admins to control the number of password reset emails sent on login attempts to user with expired passwords.

Bug fixes

• Fixed: A visual bug affecting Reports page when there are no users present in the tabs.
• Fixed: A variety of user-reported PHP warnings Warning: Attempt to read property “ID” on false inside /class-failed-logins.php.
• Fixed: User exclusion dropdown on Settings page now correctly extracts user suggestion while typing.
• Fixed: an edge case where unlocked users with WP 2FA could login without required password reset.
• Fixed: Fixed a few bugs related to the “Reset all users” feature affecting email deliverability of password reset emails.
• Fixed: a user-reported Fatal error: Uncaught TypeError: strtotime(): inside /app/class-melapress-login-security.php on line 497.
• Fixed: {reset_url} tag now correctly generates password reset URL in email templates.
• Fixed: Password expiry notice showing again after dismissal when “show again” option is disabled.

2.2.1 (2025-11-19)

Plugin & functionality improvements

• Improved handling of banner display logic to ensure consistent behavior throughout the campaign window.
• Updated plugin’s admin bar icon (correct size, alignment, and colors).
• Added the Black Friday campaign banners.
• General code and stability improvements.

Bug fixes

• Fixed a login check issue in class-failed-logins.php.
• Fixed a number of authentication conflicts with WP Cerber plugin ensuring full compatibility.
• Fixed a number of PHP warnings in class-thirdparties.php, class-check-user-expiry.php, and class-device-detection.php.
• Fixed a number of additional minor warnings reported in certain specific environments.

2.2.0 (2025-07-15)

Security fix

• Fixed a security vulnerability reported by Kr0d.

Plugin & functionality improvements

• Adjusted all emails sent by the plugin to include the new Melapress logo.
• Added more UI/UX elements to better assist the site admin during plugin configuration (e.g. Policies per role tabs).
• Added Various code sanitization checks and adjustments throughout the plugin for improved overall security.

Bug fixes

• Fixed a few logic errors that could cause “Reset all users” passwords to malfunction when certain password policies were enabled.
• Fixed a bug that caused custom role policies to not be enforced correctly and instead use the “site-wide” policies.
• Fixed the “Delete” button which was not working in the list of temporary login users.
• Fixed an issue with bulk-sending password resets from the Users page, which could have bypassed plugin policies that disallow initiating password resets.
• Fixed a user-reported 503 HTTP that could occur when password resets were initiated.
• Fixed a user-reported PHP error that could occur when editing pages on specific site/server setups.
• Fixed a bug that prevented WordPress native error messages from being hidden when the login URL had been changed.
• Fixed a user-reported bug in which users were unable to reset their password even when the disallow password resets option was disabled on a multisite network.
• Fixed an issue where the password recycling feature was not enforced on the WooCommerce password update form unless site-wide policies were active.
• Fixed a scenario that caused users excluded from all password policies to be unable to initiate a password reset.
• Fixed the aesthetics of the password policies list inside the LearnDash registration form.
• Fixed a bug that could cause the “Reset password on next login” option to not be enforced correctly for some users.
• “Restrict login based on email address or username only” now works as expected when enforced for certain roles – previously was only working as expected when used as a site-wide policy.
• Fixed support for Easy Digital Downloads forms—now fully compatible with the latest version of Easy Digital Downloads.
• Revisited all third party supported plugins and made small visual tweaks (alignment fixes, display errors etc).

2.1.1 (2025-04-07)

Plugin improvements

• Users excluded from the policies are now also exempt from Security Questions enforcement.
• Users with an expired password can now log in if the password expiry policy is disabled after their password is expired.
• Improved Temporary Logins UI with a more compact layout.
• Strengthened the overall code security by adding additional nonce and capability checks across the plugin.

Security fix

• Fixed a vulnerability reported by Wordfence: Missing authorization leading to unauthenticated arbitrary temporary user deletion.

Bug fixes

• Resolved a UI issue in the calendar view for the Temporary Logins custom expiry date filter.
• Fixed a bug that prevented the “Hide WordPress native errors on login form” feature from working correctly when the login URL was changed or when running on a multisite network.
• Multisite: Addressed PHP errors that occurred when certain plugin cron jobs were executed.
• Multisite: Addressed a bug which was causing the “User notification templates” page to be hidden on certain site setups.
• Fixed a bug preventing “Disallow old passwords” feature to work on 3rd party forms, unless “Password policies” are globally active in plugin settings.
• Fixed an internal plugin conflict between “Disallow old passwords” feature and Temporary logins, which in some edge cases could prevent new Temporary logins to be made

2.1.0 (2025-03-27)

New features

• Create temporary Logins without passwords: easily create temporary users and login links to allow users to easily access your website temporarily.
• Plain Text Email Option: Added a setting to switch all plugin email templates to plain text, stripping out all styling and HTML code.
• Customizable failed WordPress login notification: Added an option to override the default WordPress error messages for incorrect usernames or passwords for improved security.

Plugin improvements

• Improved the file validation checks when importing users for password resets from a file (txt or csv).
• All the plugin emails have a new Melapress branded theme (this can be disabled by enabling the option to send plain text emails).
• Added a new variable tag {remaining_time} which can be used in user notification templates to show how long a user is locked for.
• Improved the processing and saving of data within the plugin for better performance.
• Third-party plugin checkboxes in the Forms and Placements page are now grayed out if the relevant plugin is not installed.
• Updated the links and imagery on several plugin pages.
• Improved the code to improve performance and user processing speed on multisite networks.
• The Import/Export feature now includes all the custom email and message templates.

Security fix

• Fixed a vulnerability reported by Phan Trong Quan from VNPT Cyber Immunity.

Bug fixes

• Fixed a number of cursor focus problems on certain elements within the Settings page.
• Fixed an issue in which the correct number of remaining questions was not displayed or updated properly.
• Resolved a bug preventing answers from being saved if the required number of answers wasn’t met.
• Fixed a bug where the system information file was not being generated properly on multisite networks.
• Resolved a conflict between failed login policies and the “Reset password on first login” feature.
• Fixed an issue where password expiration policies could not be disabled in some edge cases.
• Auto populate did not work in the users filter field in “reset all passwords” form when the password policies were disabled.
• Fixed various PHP deprecation notices and warnings in different parts of the plugin to better support the most recent versions of PHP.
• Resolved an issue where users were marked as inactive despite the inactivity policy not being enabled.
• Added a number of checks to prevent multiple weekly email summaries from being sent with the wrong year.
• Fixed a bug where the global password reset feature was blocked by conflicting plugin policies.

2.0.2 (2025-01-07) – Premium edition only

Plugin features improvements & enhancements

• Introduced a new {remaining_time} shortcode in the “User Notification Templates” tab. This can be used to notify users of the remaining time before they are automatically allowed from logging in (Failed Logins policies).
• Updated Freemius SDK to version 2.11.0.
• Repositioned the “Reset all users” button to its original, more visible location, ensuring accessibility even when plugin policies are disabled.

Bug fixes

• Fixed issues with certain plugin input labels being incorrectly named.
• Resolved a bug where the Summary email was sent with an incorrect year date.
• Multisite Fix: Addressed a bug with the “disable password reset links” feature, which allowed some users to initiate a password reset from the frontend.
• Fixed a bug in the Professional (legacy license plan) and Premium plan in which users were unable to view the “User notification template” page in the Settings.

2.0.1 (2024-12-10)

New feature

• Added a setting to the login time restrictions feature that terminates user sessions when the allowed login time period expires.

Plugin improvements

• Various UI and text improvements to policies / reset all passwords area.
• * WP 2FA + Unrecognised Device policies now operate in harmony, enforcing only after 2FA has been passed.

Bug fixes

• Fixed bug which caused expired user logins to count as a failure.
• Fixed potential error caused on specific custom password-less registration methods.
• Fixed bug which stopped multiple users from being unlocked at once.
• Fixed formatting of email templates.
• Summary email: fixed ‘random’ readout of year.
• Fixed some small PHP deprecation warnings.

2.0.0 (2024-11-05)

New features

• Security questions: require users to configure security questions that can be used to verify users when resetting passwords and unlocking user accounts, thus the website administrator does not need to be involved.
• Unrecognized devices policy: users will be alerted via email each time there is a login with their username from a device that was not used before, and are also given the option to remotely log out that session.
• IP address restriction setting for the login page: restrict access to the login page by IP address(es).
• Session cookies settings: configure the expiration time of the WordPress session cookies, including those used when the user checks the “Remember me” option in the login page.
• Added the shortcode mls_user_password_expiry_notice so admins can add the password expiry notice on custom user portals etc.
• Added the hook mls_user_set_as_inactive that can be used when a user’s account is disabled by the Inactive users policy.
• Setting to restrict logins by either username or email address only. By default you can login to WordPress by using any.
• New option in the “Reset all passwords” feature that requires all users to change their password on their next login, instead of resetting the passwords of all users and sending them an email. This is mostly used for users who do not / cannot receive emails to reset their passwords.
• Setting to disable the built-in WordPress password auto suggestion when resetting or changing the password.
• Setting in the “Password expiration policy” to configure when the user should be notified of the password expiration date after dismissing the notification.
• Added out-of-the-box support for Easy Digital Downloads and ProfilePress; enforce the login and password policies on these plugins’ forms with just one-click.
• Added a “Last login time” column in the users’ page, giving the admin an easy overview of users’ login activity.

Plugin improvements

• Generic / overall code updates and enhancements – ensuring code adheres to the WordPress coding standards, added comments where needed, improved nonce checks and much more.
• Applied several coding updates that result in noticeable overall better plugin performance and resources usage.
• Every password policy can now be enabled / disabled individually, rather than all together.
• Reorganized the order of the policies in the settings, and grouped the password, user account and login policies.
• Updated all the prefixes in the plugin’s code and also in the settings to MLS_. Included a manual updating process to handle the update.
• Improved overall support for Paid Membership Pro.
• Standardized the spacing, help text placement and settings’ layout for a more uniform and easy to use UI.
• All emails the plugin uses are now available as templates that can be edited.
• Moved all wp_mail functions to a single emailer class.
• Added a default value to the “password expiry” notification setting.
• Updated several strings / help text in the plugin for better explanation and guidance for users.
• Added a default notification for when the sending of password reset links is disabled.
• Updated the email and notifications templates section; separated the notifications from the email templates, making it much easier for the user to edit them.
• Updated the default email and notification templates.
• Bumped up the minimum version of PHP to 7.3.

Bug fixes

• Fixed the check for password expiry emails – in some cases plugin was sending multiple emails to users.
• Fixed: Excluded user with admin role still locked due to inactive users policy.
• Fixed: Conflict with WP Engine MU plugin – WP Engine’s plugin does not account for an error if passed to it even if the hook returns both WP_User and WP_Error.
• Fixed: plugin was not considering the full stop character, and other characters as a special character in passwords (had a specific hardcoded list).
• Fixed: Locked users page was not showing up when using a Professional plan license.
• Fixed: Upgrade admin notice not showing up in a multisite environment.
• Fixed: Login page consent / GDPR notification shows in the login page after migration even when the setting is disabled.
• Fixed: weekly summary email reports new users as having reset their passwords.
• Fixed an edge case in which a just unlocked user cannot log in to the multisite network due to too many redirects error.
• Fixed: multiple password policies settings changes not saved when one of the changes is to set the password minimum length policy to 5.
• Fixed: failed login attempts was adding up the failed logins of multiple users when they are logging in from the same IP address, resulting in locked accounts that should have not been locked.
• Fixed: several issues with enforcing password policies on WooCommerce pages, and also improved the logic of when specific notifications should be shown on WooCommerce pages.
• Fixed: Password history feature was allowing some of the old passwords to be reused in some edge cases.
• Fixed a PHP fatal error in class-optionshelper.php which was caused when upgrading from a much older version of the plugin to the most recent one.

Previous versions changelog:

Version 1