WordPress Plugin Vulnerabilities

Login Block IPs <= 1.0.0 - IP Spoofing Bypass

Description

The function check_is_login_page() uses headers for the IP check, which can be easily spoofed.

Proof of Concept

Affects Plugins

Plugin icon
login-block-ips
No known fix

References

CVE
CVE-2022-1579

Miscellaneous

Original Researcher
Daniel Ruf
Submitter
Daniel Ruf
Submitter website
https://daniel-ruf.de
Verified
Yes
WPVDB ID
6f3d40fa-458b-44f0-9407-763e80b29668

Timeline

Publicly Published
2022-10-28 (about 3 years ago)
Added
2022-10-28 (about 3 years ago)
Last Updated
2022-10-28 (about 3 years ago)

Other

Published
Title
Published
2022-11-09
Title
Better Messages < 1.9.10.71 - Subscriber+ Messaging Block Bypass
Published
2025-01-21
Title
AdForest < 5.1.9 - Authentication Bypass
Published
2019-05-06
Title
W3 Total Cache < 0.9.7.4 - Cryptographic Signature Bypass
Published
2022-12-29
Title
Passster < 3.5.5.9 - Protection Bypass & Arbitrary Post Access
Published
2022-08-17
Title
Titan Anti-spam & Security < 7.3.1 - Protection Bypass due to IP Spoofing