Skip to content
OpenAdvisories
Medium · 5.3 Public exploit CVE-2022-4539 EUVD-2022-51874GHSA-9p7x-652m-pw9q

Web Application Firewall <= 2.1.2 - IP Address Spoofing to Protection Mechanism Bypass

Published Aug 31, 2024 · Updated Apr 8, 2026 · Assigned by Wordfence

Vendor: cyberlord92 Product: Web Application Firewall – website security Category: Web / CMS

Description

The Web Application Firewall plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.1.2. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supply the X-Forwarded-For header with with a different IP Address that will be logged and can be used to bypass settings that may have blocked out an IP address or country from logging in.

Affected products

VendorProductAffectedFixed
cyberlord92 Web Application Firewall – website security ≤ 2.1.2 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References