LimitLoginAttempts.php in the limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows a bypass of (per IP address) rate limits because the X-Forwarded-For header can be forged. When the plugin is configured to accept an arbitrary header for the client source IP address, a malicious user is not limited to perform a brute force attack, because the client IP header accepts any arbitrary string. When randomizing the header input, the login count does not ever reach the maximum allowed retries.
References
Link | Resource |
---|---|
https://n4nj0.github.io/advisories/wordpress-plugin-limit-login-attempts-reloaded/ | Third Party Advisory |
https://wordpress.org/plugins/limit-login-attempts-reloaded/#developers | Product Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2020-12-21T06:03:52
Updated: 2020-12-21T06:03:52
Reserved: 2020-12-21T00:00:00
Link: CVE-2020-35590
JSON object: View
NVD Information
Status : Analyzed
Published: 2020-12-21T07:15:14.177
Modified: 2020-12-22T20:01:42.107
Link: CVE-2020-35590
JSON object: View
Redhat Information
No data.
CWE