WP-Polls < 2.76.0 - IP Validation Bypass
CVE-2022-1581

5.3MEDIUM

Key Information:

Vendor
Wordpress
Status
WP-polls
Vendor
CVE Published:
21 November 2022

Summary

The WP-Polls WordPress plugin before 2.76.0 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based limitations to vote in certain situations.

Affected Version(s)

WP-Polls 0 < 2.76.0

References

https://wpscan.com/vulnerability/c1896ab9-9585-40e2-abbf-...
exploitvdb-entrytechnical-description
https://www.hightechdad.com/2009/12/21/warning-wp-polls-w...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Daniel Ruf
.