WordPress Plugin Vulnerabilities

User Access Manager < 2.2.18 - IP Spoofing

Description

The plugin prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible for attackers to access restricted content in certain situations.

Proof of Concept

Affects Plugins

Plugin icon
user-access-manager
Fixed in 2.2.18

References

CVE
CVE-2022-1601

Miscellaneous

Original Researcher
Daniel Ruf
Submitter
Daniel Ruf
Submitter website
https://daniel-ruf.de
Verified
Yes
WPVDB ID
f6d3408c-2ceb-4a89-822b-13f5272a5fce

Timeline

Publicly Published
2023-08-04 (about 2 years ago)
Added
2023-08-04 (about 2 years ago)
Last Updated
2023-08-04 (about 2 years ago)

Other

Published
Title
Published
2022-01-06
Title
IP2Location Country Blocker < 2.26.5 - Ban Bypass
Published
2025-09-19
Title
WP Private Content Plus <= 3.6.2 - Password Protection Bypass
Published
2017-03-13
Title
Dtracker <= 1.5 - Unauthorised Contract Creation
Published
2016-05-06
Title
Yoast SEO <= 3.2.4 - Subscriber Settings Sensitive Data Exposure
Published
2018-12-08
Title
CSS & JavaScript Toolbox <= 8.4.1 - Database backup Disclosure