{"id":"CVE-2022-4746","aliases":["EUVD-2022-52044","GHSA-733x-g8m7-q4jm"],"status":"published","title":"FluentAuth \u003c 1.0.2 - Bypass blocks by IP Spoofing","description":"The FluentAuth WordPress plugin before 1.0.2 prioritizes getting a visitor's IP address from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass the IP-based blocks set by the plugin.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00735,"percentile":0.54769,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-290"],"published":"2023-01-23T14:31:33Z","modified":"2026-10-28T02:31:12Z","products":[{"vendor":"unknown","product":"fluentauth"},{"vendor":"wpmanageninja","product":"fluentauth"}],"references":[{"url":"https://wpscan.com/vulnerability/62e3babc-00c6-4a35-972f-8f03ba70ba32","tags":["exploit","vdb-entry","technical-description","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-4746","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-733x-g8m7-q4jm"},{"url":"https://wordpress.org/plugins","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/4xxx/CVE-2022-4746.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-4746","title":"FluentAuth \u003c 1.0.2 - Bypass blocks by IP Spoofing","description":"The FluentAuth WordPress plugin before 1.0.2 prioritizes getting a visitor's IP address from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass the IP-based blocks set by the plugin.","status":"published","published":"2023-01-23T14:31:33.275Z","modified":"2025-04-02T15:49:16.779Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T14:34:37.599536Z"}],"euvd":[{"id":"EUVD-2022-52044","description":"The FluentAuth WordPress plugin before 1.0.2 prioritizes getting a visitor's IP address from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass the IP-based blocks set by the plugin.","status":"published","published":"2023-01-23T14:31:33Z","modified":"2025-04-02T15:49:16Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T20:52:44.372321Z"}],"ghsa":[{"id":"GHSA-733x-g8m7-q4jm","title":"The FluentAuth WordPress plugin before 1.0.2 prioritizes getting a visitor's IP address from...","description":"The FluentAuth WordPress plugin before 1.0.2 prioritizes getting a visitor's IP address from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass the IP-based blocks set by the plugin.","status":"published","published":"2023-01-23T15:30:32Z","modified":"2023-02-08T05:07:15Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T14:53:59.604858Z"}],"nvd":[{"id":"CVE-2022-4746","description":"The FluentAuth WordPress plugin before 1.0.2 prioritizes getting a visitor's IP address from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass the IP-based blocks set by the plugin.","status":"published","published":"2023-01-23T15:15:17.303Z","modified":"2026-06-17T05:21:43.4Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T14:07:35.561816Z"}],"osv":[{"id":"CVE-2022-4746","title":"FluentAuth \u003c 1.0.2 - Bypass blocks by IP Spoofing","description":"The FluentAuth WordPress plugin before 1.0.2 prioritizes getting a visitor's IP address from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass the IP-based blocks set by the plugin.","status":"published","published":"2023-01-23T14:31:33.275Z","modified":"2026-10-28T02:31:12.989193582Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:27.776402Z"}]}}