{"id":"CVE-2022-4100","aliases":["EUVD-2022-51470","GHSA-m748-r53c-f6pp"],"status":"published","title":"WP Cerber Security \u003c= 9.4 - IP Protection Bypass","description":"The WP Cerber Security plugin for WordPress is vulnerable to IP Protection bypass in versions up to, and including 9.4 due to the plugin improperly checking for a visitor's IP address. This makes it possible for an attacker whose IP address has been blocked to bypass this control by setting the X-Forwarded-For: HTTP header to an IP Address that hasn't been blocked.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-07","score":0.00347,"percentile":0.28476,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-693"],"published":"2024-08-31T08:35:05Z","modified":"2026-06-17T05:19:56Z","products":[{"vendor":"gioni","product":"wp cerber security, anti-spam \u0026 malware scan"},{"vendor":"gioni","product":"wp_cerber_security"},{"vendor":"unknown","product":"wp cerber security, anti-spam \u0026 malware scan"},{"vendor":"wpcerber","product":"cerber_security_antispam_\\\u0026_malware_scan"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03ccd474-42f4-4cbb-823e-93fe4db1bf80?source=cve","tags":["Third Party Advisory"]},{"url":"https://plugins.trac.wordpress.org/changeset/2865322/wp-cerber/trunk/cerber-common.php","tags":["Patch"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-4100"},{"url":"https://github.com/advisories/GHSA-m748-r53c-f6pp"}],"sources":{"cve":[{"id":"CVE-2022-4100","title":"WP Cerber Security \u003c= 9.4 - IP Protection Bypass","description":"The WP Cerber Security plugin for WordPress is vulnerable to IP Protection bypass in versions up to, and including 9.4 due to the plugin improperly checking for a visitor's IP address. This makes it possible for an attacker whose IP address has been blocked to bypass this control by setting the X-Forwarded-For: HTTP header to an IP Address that hasn't been blocked.","status":"published","published":"2024-08-31T08:35:05.543Z","modified":"2026-04-08T16:33:01.395Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T14:34:37.932195Z"}],"euvd":[{"id":"EUVD-2022-51470","description":"The WP Cerber Security plugin for WordPress is vulnerable to IP Protection bypass in versions up to, and including 9.4 due to the plugin improperly checking for a visitor's IP address. This makes it possible for an attacker whose IP address has been blocked to bypass this control by setting the X-Forwarded-For: HTTP header to an IP Address that hasn't been blocked.","status":"published","published":"2024-08-31T08:35:05Z","modified":"2026-04-08T16:33:01Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:25:11.239745Z"}],"ghsa":[{"id":"GHSA-m748-r53c-f6pp","title":"The WP Cerber Security plugin for WordPress is vulnerable to IP Protection bypass in versions up...","description":"The WP Cerber Security plugin for WordPress is vulnerable to IP Protection bypass in versions up to, and including 9.4 due to the plugin improperly checking for a visitor's IP address. This makes it possible for an attacker whose IP address has been blocked to bypass this control by setting the X-Forwarded-For: HTTP header to an IP Address that hasn't been blocked.","status":"published","published":"2024-08-31T09:30:44Z","modified":"2024-08-31T09:30:50Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T14:58:09.209202Z"}],"nvd":[{"id":"CVE-2022-4100","description":"The WP Cerber Security plugin for WordPress is vulnerable to IP Protection bypass in versions up to, and including 9.4 due to the plugin improperly checking for a visitor's IP address. This makes it possible for an attacker whose IP address has been blocked to bypass this control by setting the X-Forwarded-For: HTTP header to an IP Address that hasn't been blocked.","status":"published","published":"2024-08-31T09:15:03.72Z","modified":"2026-06-17T05:19:56.997Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T14:07:40.977475Z"}]}}