IP Address Spoofing Vulnerability in WordPress Login and Registration Attempts Limit Plugin

CVE-2022-4532

What is CVE-2022-4532?

The LOGIN AND REGISTRATION ATTEMPTS LIMIT plugin for WordPress is susceptible to IP address spoofing due to inadequate measures in restricting the source of IP address logging. This vulnerability allows attackers to manipulate the X-Forwarded-For header to log a misleading IP address. As a result, attackers can bypass login restrictions intended to block specific IP addresses from gaining access. This security oversight highlights the importance of effective IP address verification methods in safeguarding user authentication processes within WordPress sites.

References