7.5
High
CVE-2022-4746 The FluentAuth WordPress plugin before 1.0.2 prioritizes getting a visitor's IP address from certain HTTP headers over…
Description
The FluentAuth WordPress plugin before 1.0.2 prioritizes getting a visitor's IP address from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass the IP-based blocks set by the plugin.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| FluentAuth 1.0 | earliest → < 1.0.2 | 1.0.2 |