Threats tagged 'ghsa-4qw6-7g5m-4mvh'

The OOPSpam Anti-Spam plugin for WordPress versions up to and including 1.2.53 is vulnerable to IP Header Spoofing. The plugin trusts client-controlled forwarded headers such as CF-Connecting-IP and X-Forwarded-For without verifying their legitimacy. This allows unauthenticated attackers to spoof their IP address and bypass IP-based security controls like blocked IP lists and rate limiting.