WP Limit Login Attempts <= 2.6.4 - IP Spoofing

The plugin prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTEADDR, which makes it possible to bypass IP-based restrictions on login forms. Set HTTPCLIENTIP or HTTPXFORWARDEDFOR as used in wplimitgetip to spoof the IP address and bypass the block...

Login Block IPs <= 1.0.0 - IP Spoofing Bypass

The function checkisloginpage uses headers for the IP check, which can be easily spoofed. Set HTTPCLIENTIP to bypass blocks / use allowed IP addresses...

PT-2019-7425

Name of the Vulnerable Software and Affected Versions wti-like-post plugin versions prior to 1.4.3 Description The issue concerns SQL injection via the HTTP CLIENT IP, HTTP X FORWARDED FOR, HTTP X FORWARDED, HTTP FORWARDED FOR, or HTTP FORWARDED variable in the WtiLikePostProcessVote function...