Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2024-0789

WP Maintenance <= 6.1.9.2 - IP Spoofing to Maintenance Mode Bypass

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Wordfence

Description

The WP Maintenance plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 6.1.9.2 due to insufficient IP address validation and use of user-supplied HTTP headers as a primary method for IP retrieval. This makes it possible for unauthenticated attackers to bypass maintenance mode.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

florent73 WP Maintenance

Default version status: unaffected

  • 0 to ≤ 6.1.9.2affected

References