{"id":"CVE-2026-8616","aliases":["EUVD-2026-45126","GHSA-56hc-jghx-566j"],"status":"published","title":"Fense Proxy \u0026 VPN Blocker \u003c= 3.0.1 - Missing Authorization to Unauthenticated Plugin Option/Transient Deletion via fense_bpvt_save_settings AJAX Action","description":"The Fense Proxy \u0026 VPN Blocker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce validation on the fense_bpvt_save_settings() function in versions up to, and including, 3.0.1. The callback is registered to both wp_ajax_* and wp_ajax_nopriv_* hooks and unconditionally calls delete_option() on four plugin options and delete_transient() on three transients tied to the plugin's API key cache and settings. This makes it possible for unauthenticated attackers to delete plugin options and transients, effectively resetting the plugin's API key/data cache and forcing the plugin to refetch state.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00391,"percentile":0.33567,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2026-07-17T02:31:30Z","modified":"2026-07-21T02:16:23Z","products":[{"vendor":"devozon","product":"fense proxy \u0026 vpn blocker"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1208ac78-4a56-4daa-b935-d579f07f8e8e?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/fense-block-vpn-proxy/tags/2.9.0/includes/system/fense-bpvt-header-code.php#L32"},{"url":"https://plugins.trac.wordpress.org/browser/fense-block-vpn-proxy/tags/2.9.0/includes/system/fense-bpvt-header-code.php#L48"},{"url":"https://plugins.trac.wordpress.org/browser/fense-block-vpn-proxy/tags/3.0.2/includes/system/header-code.php?rev=3574545"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8616"},{"url":"https://github.com/advisories/GHSA-56hc-jghx-566j"}],"sources":{"cve":[{"id":"CVE-2026-8616","title":"Fense Proxy \u0026 VPN Blocker \u003c= 3.0.1 - Missing Authorization to Unauthenticated Plugin Option/Transient Deletion via fense_bpvt_save_settings AJAX Action","description":"The Fense Proxy \u0026 VPN Blocker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce validation on the fense_bpvt_save_settings() function in versions up to, and including, 3.0.1. The callback is registered to both wp_ajax_* and wp_ajax_nopriv_* hooks and unconditionally calls delete_option() on four plugin options and delete_transient() on three transients tied to the plugin's API key cache and settings. This makes it possible for unauthenticated attackers to delete plugin options and transients, effectively resetting the plugin's API key/data cache and forcing the plugin to refetch state.","status":"published","published":"2026-07-17T02:31:30.556Z","modified":"2026-07-21T01:26:04.428Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T13:48:13.398044Z"}],"euvd":[{"id":"EUVD-2026-45126","description":"The Fense Proxy \u0026 VPN Blocker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce validation on the fense_bpvt_save_settings() function in versions up to, and including, 3.0.1. The callback is registered to both wp_ajax_* and wp_ajax_nopriv_* hooks and unconditionally calls delete_option() on four plugin options and delete_transient() on three transients tied to the plugin's API key cache and settings. This makes it possible for unauthenticated attackers to delete plugin options and transients, effectively resetting the plugin's API key/data cache and forcing the plugin to refetch state.","status":"published","published":"2026-07-17T02:31:30Z","modified":"2026-07-21T01:26:04Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:19:47.959089Z"}],"ghsa":[{"id":"GHSA-56hc-jghx-566j","title":"The Fense Proxy \u0026 VPN Blocker plugin for WordPress is vulnerable to unauthorized modification of...","description":"The Fense Proxy \u0026 VPN Blocker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce validation on the fense_bpvt_save_settings() function in versions up to, and including, 3.0.1. The callback is registered to both wp_ajax_* and wp_ajax_nopriv_* hooks and unconditionally calls delete_option() on four plugin options and delete_transient() on three transients tied to the plugin's API key cache and settings. This makes it possible for unauthenticated attackers to delete plugin options and transients, effectively resetting the plugin's API key/data cache and forcing the plugin to refetch state.","status":"published","published":"2026-07-17T06:30:59Z","modified":"2026-07-17T06:31:06Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:09:34.599528Z"}],"nvd":[{"id":"CVE-2026-8616","description":"The Fense Proxy \u0026 VPN Blocker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce validation on the fense_bpvt_save_settings() function in versions up to, and including, 3.0.1. The callback is registered to both wp_ajax_* and wp_ajax_nopriv_* hooks and unconditionally calls delete_option() on four plugin options and delete_transient() on three transients tied to the plugin's API key cache and settings. This makes it possible for unauthenticated attackers to delete plugin options and transients, effectively resetting the plugin's API key/data cache and forcing the plugin to refetch state.","status":"published","published":"2026-07-17T04:16:51.197Z","modified":"2026-07-21T02:16:23.787Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:12:30.250437Z"}]}}