WordPress Plugin Vulnerabilities

All In One WP Security & Firewall < 5.0.8 - IP Spoofing

Description

The plugin is susceptible to IP Spoofing attacks, which can lead to bypassed security features (like IP blocks, rate limiting, brute force protection, and more).

Proof of Concept

Affects Plugins

Plugin icon
all-in-one-wp-security-and-firewall
Fixed in 5.0.8

References

CVE
CVE-2022-4097

Miscellaneous

Original Researcher
Daniel Ruf
Submitter
Daniel Ruf
Submitter website
https://daniel-ruf.de
Verified
Yes
WPVDB ID
15819d33-7497-4f7d-bbb8-b3ab147806c4

Timeline

Publicly Published
2022-11-21 (about 3 years ago)
Added
2022-11-21 (about 3 years ago)
Last Updated
2022-11-21 (about 3 years ago)

Other

Published
Title
Published
2022-10-28
Title
Login Block IPs <= 1.0.0 - IP Spoofing Bypass
Published
2020-01-21
Title
WordPress <= 5.2.3 - Hardening Bypass
Published
2022-11-09
Title
Better Messages < 1.9.10.71 - Subscriber+ Messaging Block Bypass
Published
2015-04-06
Title
QAEngine Theme - Privilege Escalation
Published
2025-07-24
Title
PPWP < 1.9.11 - Subscriber+ Access Bypass via REST API