WP Maintenance, CVE-2024-0789

CVE, Research URL: CVE-2024-0789
Home page URL: Security reports for WP Maintenance
Application: WP Maintenance
Published on: Jun 19, 2024
Research Description: The WP Maintenance plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 6.1.9.2 due to insufficient IP address validation and use of user-supplied HTTP headers as a primary method for IP retrieval. This makes it possible for unauthenticated attackers to bypass maintenance mode.
Affected versions: Min -, max 6.1.9.3.
Status: vulnerable