CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-48753 – WordPress Restricted Site Access plugin <= 7.4.1 - IP Restriction Bypass vulnerability
https://notcve.org/view.php?id=CVE-2023-48753
Authentication Bypass by Spoofing vulnerability in 10up Restricted Site Access allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Restricted Site Access: from n/a through 7.4.1. La vulnerabilidad de omisión de autenticación mediante suplantación de identidad en 10up Restricted Site Access permite el acceso a una funcionalidad no restringida adecuadamente por las ACL. Este problema afecta a Restricted Site Access: desde n/a hasta 7.4.1. The Restricted Site Access plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 6.3.0. This is due to insufficient restrictions on where the IP Address information is being retrieved for user IP Addresses. • https://patchstack.com/database/vulnerability/restricted-site-access/wordpress-restricted-site-access-plugin-7-4-1-ip-restriction-bypass-vulnerability?_s_id=cve • CWE-290: Authentication Bypass by Spoofing CWE-348: Use of Less Trusted Source •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2022-1613 – Restricted Site Access < 7.3.2 - Access Bypass via IP Spoofing
https://notcve.org/view.php?id=CVE-2022-1613
The Restricted Site Access WordPress plugin before 7.3.2 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based limitations in certain situations. El plugin Restricted Site Access de WordPress versiones anteriores a 7.3.2, prioriza la obtención de la IP de un visitante a partir de determinados encabezados HTTP sobre REMOTE_ADDR de PHP, lo que hace posible saltarse las limitaciones basadas en la IP en determinadas situaciones. The Restricted Site Access plugin for WordPress is vulnerable to IP Spoofing in versions up to, and including, 7.3.1 due to prioritizing getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR. This makes it possible to bypass IP-based limitations in certain situations. • https://wpscan.com/vulnerability/c03863ef-9ac9-402b-8f8d-9559c9988e2b • CWE-639: Authorization Bypass Through User-Controlled Key •