// For flags

CVE-2023-48753

WordPress Restricted Site Access plugin <= 7.4.1 - IP Restriction Bypass vulnerability

Severity Score

5.3
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Attend
*SSVC
Descriptions

Authentication Bypass by Spoofing vulnerability in 10up Restricted Site Access allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Restricted Site Access: from n/a through 7.4.1.

La vulnerabilidad de omisión de autenticación mediante suplantación de identidad en 10up Restricted Site Access permite el acceso a una funcionalidad no restringida adecuadamente por las ACL. Este problema afecta a Restricted Site Access: desde n/a hasta 7.4.1.

The Restricted Site Access plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 6.3.0. This is due to insufficient restrictions on where the IP Address information is being retrieved for user IP Addresses. This makes it possible for attackers to gain access to areas of the site that may have been restricted.

*Credits: Mika (Patchstack Alliance)
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Attend
Exploitation
None
Automatable
Yes
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2023-11-18 CVE Reserved
  • 2023-11-27 CVE Published
  • 2024-06-06 EPSS Updated
  • 2024-08-02 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-290: Authentication Bypass by Spoofing
  • CWE-348: Use of Less Trusted Source
CAPEC
  • CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Restricted Site Access
Search vendor "Restricted Site Access"
 Restricted Site Access
Search vendor "Restricted Site Access" for product "Restricted Site Access"
 >= 0.0.0 <= 7.4.1
Search vendor "Restricted Site Access" for product "Restricted Site Access" and version " >= 0.0.0 <= 7.4.1"
en
Affected