CSRF Vulnerability in IP Based Login Plugin for WordPress
CVE-2024-13118
Key Information:
- Vendor
- WordPress
- Status
- Vendor
- CVE Published:
- 25 March 2025
Badges
Summary
The IP Based Login plugin for WordPress, prior to version 2.4.1, is susceptible to Cross-Site Request Forgery (CSRF) attacks. This vulnerability arises from the absence of adequate CSRF checks, allowing attackers to exploit legitimate user sessions and perform unauthorized actions on behalf of logged-in users, such as deleting log entries. Such exploitation undermines user data integrity and poses severe security risks to WordPress installations utilizing this plugin.
Affected Version(s)
IP Based Login 0 < 2.4.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V3.1
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved