Description
The function check_is_login_page() uses headers for the IP check, which can be easily spoofed.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Login Block IPs | ≤ 1.0.0 | — |
References
- https://wpscan.com/vulnerability/6f3d40fa-458b-44f0-9407-763e80b29668 exploit vdb-entry technical-description