IP Address Spoofing Vulnerability in Hide My WP Ghost Security Plugin for WordPress

CVE-2022-4537

Summary

The Hide My WP Ghost – Security Plugin for WordPress is susceptible to IP Address Spoofing due to inadequate restrictions governing the retrieval of IP address information for request logging and login limit enforcement. This vulnerability enables attackers to manipulate the X-Forwarded-For header to present a misleading IP address, which may subsequently bypass any settings that would normally prevent that IP from accessing the system. As a result, unauthorized users can gain access where they should otherwise be blocked.

References