// For flags

CVE-2022-4539

Web Application Firewall <= 2.1.2 - IP Address Spoofing to Protection Mechanism Bypass

Severity Score

5.3
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Attend
*SSVC
Descriptions

The Web Application Firewall plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.1.2. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supply the X-Forwarded-For header with with a different IP Address that will be logged and can be used to bypass settings that may have blocked out an IP address or country from logging in.

*Credits: Mohammadreza Rashidi
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
None
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Attend
Exploitation
None
Automatable
Yes
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2022-12-16 CVE Reserved
  • 2024-08-30 CVE Published
  • 2024-09-01 EPSS Updated
  • 2024-09-01 First Exploit
  • 2024-09-03 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-348: Use of Less Trusted Source
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Cyberlord92
Search vendor "Cyberlord92"
 Web Application Firewall – Website Security
Search vendor "Cyberlord92" for product "Web Application Firewall – Website Security"
 <= 2.1.2
Search vendor "Cyberlord92" for product "Web Application Firewall – Website Security" and version " <= 2.1.2"
en
Affected