User Access Manager < 2.2.18 - IP Spoofing

2023-08-0400:00:00

Daniel Ruf

user access manager

ip spoofing

http_x_real_ip

allowlist

exploit

5.3 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.1%

JSON

Description The plugin prioritizes getting a visitor’s IP from certain HTTP headers over PHP’s REMOTE_ADDR, which makes it possible for attackers to access restricted content in certain situations.

Set HTTP_X_REAL_IP which is used in checkUserGroupAccess() to use an IP from the allowlist.