WordPress Plugin Vulnerabilities

All In One WP Security & Firewall < 5.0.8 - IP Spoofing

Description

The plugin is susceptible to IP Spoofing attacks, which can lead to bypassed security features (like IP blocks, rate limiting, brute force protection, and more).

Proof of Concept

Set HTTP_X_REAL_IP or HTTP_X_FORWARDED_FOR used in get_user_ip_address() to bypass IP-based blocks.

Affects Plugins

Plugin icon
all-in-one-wp-security-and-firewall
Fixed in 5.0.8

References

CVE
CVE-2022-4097

Miscellaneous

Original Researcher
Daniel Ruf
Submitter
Daniel Ruf
Submitter website
https://daniel-ruf.de
Verified
Yes
WPVDB ID
15819d33-7497-4f7d-bbb8-b3ab147806c4

Timeline

Publicly Published
2022-11-21 (about 1 years ago)
Added
2022-11-21 (about 1 years ago)
Last Updated
2022-11-21 (about 1 years ago)

Other

Published
Title
Published
2024-01-27
Title
BookingPress < 1.0.75 - Unauthenticated Booking Price Manipulation
Published
2017-09-08
Title
BackWPup <= 3.4.1 - Backup File Download
Published
2020-05-07
Title
Ultimate Addons for Elementor < 1.24.2 - Registration Bypass
Published
2017-01-04
Title
Stop User Enumeration <= 1.3.4 - Username Enumeration Bypasses
Published
2022-05-03
Title
Helpful < 4.5.15 - Votes Tampering