Restricted Site Access <= 7.3.1 is vulnerable to Access Bypass via IP Spoofing vulnerability

Unauthenticated

Published
2022-08-30

The Restricted Site Access plugin for WordPress is vulnerable to IP Spoofing in versions up to, and including, 7.3.1 due to prioritizing getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR. This makes it possible to bypass IP-based limitations in certain situations.

CVE

https://www.cve.org/CVERecord?id=CVE-2022-1613

CVSS

Score:5.3

Severity:Medium

Version: 7.3.1

There is a patch available in v7.3.2 and we strongly recommend you update to this version as soon as possible.