← Back to CVEs
CVE-2020-35590
CRITICAL9.8
Description
LimitLoginAttempts.php in the limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows a bypass of (per IP address) rate limits because the X-Forwarded-For header can be forged. When the plugin is configured to accept an arbitrary header for the client source IP address, a malicious user is not limited to perform a brute force attack, because the client IP header accepts any arbitrary string. When randomizing the header input, the login count does not ever reach the maximum allowed retries.
CVE Details
CVSS v3.1 Score9.8
SeverityCRITICAL
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack VectorNETWORK
ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
Published12/21/2020
Last Modified11/21/2024
Sourcenvd
Honeypot Sightings0
Affected Products
limitloginattempts:limit_login_attempts_reloaded
Weaknesses (CWE)
CWE-307
References
https://n4nj0.github.io/advisories/wordpress-plugin-limit-login-attempts-reloaded/(af854a3a-2127-422b-91ae-364da2661108)
https://wordpress.org/plugins/limit-login-attempts-reloaded/#developers(af854a3a-2127-422b-91ae-364da2661108)
IOC Correlations
No correlations recorded
This product uses data from the NVD API but is not endorsed or certified by the NVD.