Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix/367 Bypass Vulnerability Fix #368

Merged
merged 1 commit into from
Mar 7, 2024

Conversation

bmarshall511
Copy link
Collaborator

@bmarshall511 bmarshall511 commented Mar 7, 2024

Description of the Change

Addresses https://patchstack.com/database/report-preview/c3c10882-9241-4bc3-a589-29f743bcf494?pin=nOv31SVbrrIdLYDH

Closes #367

How to test the Change

Get yourself banned in any ways, like posting tons of comments. You should see a 'Your IP has been flagged as spam/malicious'. Then make another comment and this time, add ?anything.ico in the url.

Go to http://127.0.0.1/wordpress/wp-admin/options-general.php?page=wordpress-zero-spam-settings&subview=settings and add an ip entry in the ip address whitelist, like 127.0.0.1. Get yourself banned by any means allowed by the plugin. Make another request, but this time, add a X-Forwarded-For header with the value 127.0.0.1

Changelog Entry

Security - Vulnerability: Fixed bypass methods for blocked IP addresses

Credits

Props @bmarshall511

Checklist:

  • I agree to follow this project's Code of Conduct.
  • I have updated the documentation accordingly.
  • I have added tests to cover my change.
  • All new and existing tests pass.

@bmarshall511 bmarshall511 self-assigned this Mar 7, 2024
@bmarshall511 bmarshall511 merged commit d55b1f9 into develop Mar 7, 2024
1 check failed
@bmarshall511 bmarshall511 deleted the fix/367-bypass-vulnerability branch March 7, 2024 15:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

WordPress Zero Spam Plugin <= 5.5.1 is vulnerable to Bypass Vulnerability
1 participant