Description

WordPress Plugin WP-Ban is prone to a security bypass vulnerability. Attackers can exploit this vulnerability in some circumstances by setting the "X-Forwarded-For" HTTP header field and thus bypassing IP blacklisting functionality. WordPress Plugin WP-Ban version 1.63 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 1.64 or latest

References

https://security.dxw.com/advisories/vulnerability-in-wp-ban-allows-visitors-to-bypass-the-ip-blacklist-in-some-configurations/

http://packetstormsecurity.com/files/128292/WordPress-WP-Ban-1.62-Bypass.html

http://secunia.com/advisories/61347/

https://wordpress.org/plugins/wp-ban/changelog/

Related Vulnerabilities

Nexus Repository Manager Use of a Broken or Risky Cryptographic Algorithm Vulnerability (CVE-2017-17717)

WordPress Plugin Responsive WordPress Slider Cross-Site Scripting (2.2.0)

WeBid Permissions, Privileges, and Access Controls Vulnerability (CVE-2008-7118)

WordPress Plugin All-In-One Security (AIOS)-Security and Firewall Directory Traversal (5.1.4)

Moodle Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-32244)

Severity

High

Classification

CVE-2014-6230 CWE-284 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update Authentication Bypass