SecuPress Free — WordPress Security, CVE-2024-1504

CVE, Research URL: CVE-2024-1504
Home page URL: Security reports for SecuPress Free — WordPress Security
Application: SecuPress Free — WordPress Security
Published on: Apr 02, 2024
Research Description: The SecuPress Free — WordPress Security plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.5.1. This is due to missing or incorrect nonce validation on the secupress_blackhole_ban_ip() function. This makes it possible for unauthenticated attackers to block a user's IP via a forged request granted they can trick the user into performing an action such as clicking on a link.
Affected versions: Min -, max 2.2.5.2.
Status: vulnerable