All In One WP Security & Firewall 5.0.0 - 5.0.7 - Protection Bypass via IP Spoofing
2022-09-30 00:00
Calvin AlkanStrategic Overview
StatusPatched in 5.0.8
Affected PluginAll-In-One Security (AIOS) – Security and Firewall
Affected Version
5.0.0 – 5.0.7CVSS6.5Medium
CVE
N/AVulnerability Overview
The All In One WP Security & Firewall plugin for WordPress is vulnerable to IP Address Spoofing in versions 5.0.0 - 5.0.7 (both included) due to insufficient IP address validation. This makes it possible for attackers to bypass IP blocks and access services even if their IP address is blocked.
Technical Analysis
REMEDIATION: Update to version 5.0.8, or a newer patched version --- IDENTIFIER: CWE-348 (Use of Less Trusted Source) The product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C