CVE-2022-4303

CVE-2022-4303 affects the WordPress plugin WP Limit Login Attempts (versions up to 2.6.4). The root cause is that it prioritizes a visitor’s IP from certain HTTP headers over PHP’s REMOTE_ADDR, allowing bypass of IP-based login restrictions. This can enable an attacker to circumvent login form pr...

CVE-2015-6829

WP Limit Login Attempts plugin for WordPress (getip function) contains SQL injection vulnerabilities exploitable via the X-Forwarded-For and Client-IP HTTP headers. Affected versions are before 2.0.1. Consequences include arbitrary SQL execution on the database. Mitigation per connected sources i...