CVE-2022-4746

HIGH

FluentAuth < 1.0.2 - Authentication Bypass via HTTP Header Spoofing

Title source: llm

Description

The FluentAuth WordPress plugin before 1.0.2 prioritizes getting a visitor's IP address from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass the IP-based blocks set by the plugin.

References (1)

Core 1

Core References

Exploit, Third Party Advisory exploit vdb-entry technical-description

https://wpscan.com/vulnerability/62e3babc-00c6-4a35-972f-8f03ba70ba32

Scores

CVSS v3 7.5

EPSS 0.0073

EPSS Percentile 49.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact partial

Details

CWE

CWE-290

Status published

Products (1)

wpmanageninja/fluentauth < 1.0.2

Published Jan 23, 2023

Tracked Since Feb 18, 2026