WP Limit Login Attempts <= 2.6.4 - IP Spoofing

2022-12-2700:00:00

Daniel Ruf

268

wordpress

ip spoofing

http client ip

http x forwarded for

bypass

exploit

EPSS

0.001

Percentile

33.7%

JSON

The plugin prioritizes getting a visitor’s IP from certain HTTP headers over PHP’s REMOTE_ADDR, which makes it possible to bypass IP-based restrictions on login forms.

Set HTTP_CLIENT_IP or HTTP_X_FORWARDED_FOR as used in wp_limit_getip() to spoof the IP address and bypass the block.

EPSS

0.001

Percentile

33.7%

JSON

Related for WPEX-ID:8428A5E1-DBEF-4516-983F-F95605C6DD09