CVE-2022-4746
FluentAuth < 1.0.2 - Bypass blocks by IP Spoofing
HIGH 7.5EPSS 0.7%
The FluentAuth WordPress plugin before 1.0.2 prioritizes getting a visitor's IP address from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass the IP-based blocks set by the plugin.
- Affected
- FluentAuth
- CVSS v3.1 NVD
- 7.5 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - EPSS
- 0.73% chance of exploitation in the next 30 days, 53rd percentile
- Published
- 2023-01-23
- Updated
- 2025-04-02