Vulnerabilities

TI-2022-03748 CVE-2022-4100 · GHSA-m748-r53c-f6pp

WP Cerber Security <= 9.4 - IP Protection Bypass

LOW 30

The WP Cerber Security plugin for WordPress is vulnerable to IP Protection bypass in versions up to, and including 9.4 due to the plugin improperly checking for a visitor's IP address.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00347 Published 2024-08-31 No fix listed CWE-693

TI-2021-15479 CVE-2021-37597 · GHSA-hwhr-mg66-h8cp

WP Cerber before 8.9.3 allows MFA bypass via wordpress_logged_in_[hash] manipulation.

MEDIUM 46

WP Cerber before 8.9.3 allows MFA bypass via wordpress_logged_in_[hash] manipulation.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02124 Published 2021-08-19 No fix listed CWE-287

TI-2021-15480 CVE-2021-37598 · GHSA-7fw3-2wmp-j43f

WP Cerber before 8.9.3 allows bypass of /wp-json access control via a trailing ? character.

LOW 29

WP Cerber before 8.9.3 allows bypass of /wp-json access control via a trailing ? character.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0235 Published 2021-08-19 No fix listed CWE-863

TI-2016-09028 CVE-2016-10990 · GHSA-32r5-6c8g-f64h

The wp-cerber plugin before 2.7 for WordPress has XSS via the X-Forwarded-For HTTP header.

LOW 30

The wp-cerber plugin before 2.7 for WordPress has XSS via the X-Forwarded-For HTTP header.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01418 Published 2019-09-17 No fix listed CWE-79

Vulnerabilities

Filters

WP Cerber Security <= 9.4 - IP Protection Bypass

WP Cerber before 8.9.3 allows MFA bypass via wordpress_logged_in_[hash] manipulation.

WP Cerber before 8.9.3 allows bypass of /wp-json access control via a trailing ? character.

The wp-cerber plugin before 2.7 for WordPress has XSS via the X-Forwarded-For HTTP header.