The FluentAuth WordPress plugin before 1.0.2 prioritizes getting a visitors IP address from certain HTTP headers over PHPs REMOTE_ADDR, which makes it possible to bypass the IP-based blocks set by the plugin.
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Fluentauth | Wpmanageninja | * | 1.0.2 (excluding) |