CVE-2024-13685

The Admin and Site Enhancements (ASE) WordPress plugin before 7.6.10 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate their value to bypass the login limit feature in the Admin and Site Enhancements (ASE) WordPress plugin before 7.6.10.

Score

CVSS 3.1 5.3 Medium

Status

Analyzed - contact@wpscan.com

Published

2025-03-04

Last modified

2025-03-04

Weaknesses

CWE-290

Affected products

• Admin And Site Enhancements Ase (Unknown)
• Admin And Site Enhancements (Wpase)

References

• https://wpscan.com/vulnerability/72c61904-253d-42d1-9edd-7ea2162a2f85/