WordPress Plugin Vulnerabilities

User Access Manager < 2.2.18 - IP Spoofing

Description

The plugin prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible for attackers to access restricted content in certain situations.

Proof of Concept

Set HTTP_X_REAL_IP which is used in checkUserGroupAccess() to use an IP from the allowlist.

Affects Plugins

Plugin icon
user-access-manager
Fixed in 2.2.18

References

CVE
CVE-2022-1601

Miscellaneous

Original Researcher
Daniel Ruf
Submitter
Daniel Ruf
Submitter website
https://daniel-ruf.de
Verified
Yes
WPVDB ID
f6d3408c-2ceb-4a89-822b-13f5272a5fce

Timeline

Publicly Published
2023-08-04 (about 9 months ago)
Added
2023-08-04 (about 9 months ago)
Last Updated
2023-08-04 (about 9 months ago)

Other

Published
Title
Published
2023-10-24
Title
YOP Poll < 6.5.29 - Reusable Captcha via validateImage
Published
2023-03-02
Title
Metform Elementor Contact Form Builder < 3.2.2 - reCaptcha Bypass
Published
2020-02-22
Title
CardGate < 3.1.16 - Unauthorised Payments Hijacking and Order Status Spoofing
Published
2015-04-06
Title
QAEngine Theme - Privilege Escalation
Published
2020-10-02
Title
WordPress + Microsoft Office 365 < 11.7 - JWT Signature Verification Bypass