CVE-2024-13685

Admin and Site Enhancements (ASE) < 7.6.10 - Limit Login Attempt Bypass via IP Spoofing

The Admin and Site Enhancements (ASE) WordPress plugin before 7.6.10 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate their value to bypass the login limit feature in the Admin and Site Enhancements (ASE) WordPress plugin before 7.6.10.

Affected

Admin and Site Enhancements (ASE)

CVSS v3.1 CNA

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS

0.37% chance of exploitation in the next 30 days, 29th percentile

Published

2025-03-04

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/72c61904-253d-42d1-9edd-7ea2162a2f85/

Security advisories

• https://wpscan.com/vulnerability/72c61904-253d-42d1-9edd-7ea2162a2f85

References

• CVE Record
• NVD entry