The WP Limit Login Attempts WordPress plugin through 2.6.4 prioritizes getting a visitors IP from certain HTTP headers over PHPs REMOTE_ADDR, which makes it possible to bypass IP-based restrictions on login forms.
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Wp_limit_login_attempts | Ciphercoin | * | 2.6.4 (including) |