{"id":"CVE-2022-2877","aliases":["EUVD-2022-35109","GHSA-m5jh-xgpc-2h9r"],"status":"published","title":"Titan Anti-spam \u0026 Security \u003c 7.3.1 - Protection Bypass due to IP Spoofing","description":"The Titan Anti-spam \u0026 Security WordPress plugin before 7.3.1 does not properly checks HTTP headers in order to validate the origin IP address, allowing threat actors to bypass it's block feature by spoofing the headers.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00758,"percentile":0.5549,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-639"],"published":"2022-09-16T08:40:37Z","modified":"2026-06-17T04:42:45Z","products":[{"vendor":"cm-wp","product":"titan_anti-spam_\\\u0026_security"},{"vendor":"creativemotion","product":"titan anti-spam \u0026 security"},{"vendor":"unknown","product":"titan anti-spam \u0026 security"}],"references":[{"url":"https://wpscan.com/vulnerability/f1af4267-3a43-4b88-a8b9-c1d5b2aa9d68","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2877"},{"url":"https://github.com/advisories/GHSA-m5jh-xgpc-2h9r"}],"sources":{"cve":[{"id":"CVE-2022-2877","title":"Titan Anti-spam \u0026 Security \u003c 7.3.1 - Protection Bypass due to IP Spoofing","description":"The Titan Anti-spam \u0026 Security WordPress plugin before 7.3.1 does not properly checks HTTP headers in order to validate the origin IP address, allowing threat actors to bypass it's block feature by spoofing the headers.","status":"published","published":"2022-09-16T08:40:37Z","modified":"2024-08-03T00:52:59.794Z","cwes":["CWE-639"],"updated_at":"2026-11-02T14:34:32.156873Z"}],"euvd":[{"id":"EUVD-2022-35109","description":"The Titan Anti-spam \u0026 Security WordPress plugin before 7.3.1 does not properly checks HTTP headers in order to validate the origin IP address, allowing threat actors to bypass it's block feature by spoofing the headers.","status":"published","published":"2022-09-16T08:40:37Z","modified":"2024-08-03T00:52:59Z","updated_at":"2026-11-03T03:25:57.460299Z"}],"ghsa":[{"id":"GHSA-m5jh-xgpc-2h9r","title":"The Titan Anti-spam \u0026 Security WordPress plugin before 7.3.1 does not properly checks HTTP...","description":"The Titan Anti-spam \u0026 Security WordPress plugin before 7.3.1 does not properly checks HTTP headers in order to validate the origin IP address, allowing threat actors to bypass it's block feature by spoofing the headers.","status":"published","published":"2022-09-17T00:00:41Z","modified":"2023-01-29T05:03:10Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:45:15.626641Z"}],"nvd":[{"id":"CVE-2022-2877","description":"The Titan Anti-spam \u0026 Security WordPress plugin before 7.3.1 does not properly checks HTTP headers in order to validate the origin IP address, allowing threat actors to bypass it's block feature by spoofing the headers.","status":"published","published":"2022-09-16T09:15:11.137Z","modified":"2026-06-17T04:42:45.34Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:07:28.118799Z"}]}}