The Admin and Site Enhancements (ASE) WordPress plugin before 7.6.10 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate their value to bypass the login limit feature in the Admin and Site Enhancements (ASE) WordPress plugin before 7.6.10.
References
| Link | Resource |
|---|---|
| https://wpscan.com/vulnerability/72c61904-253d-42d1-9edd-7ea2162a2f85/ | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
14 May 2025, 14:51
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://wpscan.com/vulnerability/72c61904-253d-42d1-9edd-7ea2162a2f85/ - Exploit, Third Party Advisory | |
| Summary |
|
|
| First Time |
Wpase
Wpase admin And Site Enhancements |
|
| CWE | CWE-290 | |
| CPE | cpe:2.3:a:wpase:admin_and_site_enhancements:*:*:*:*:free:wordpress:*:* cpe:2.3:a:wpase:admin_and_site_enhancements:*:*:*:*:pro:wordpress:*:* |
04 Mar 2025, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.3 |
04 Mar 2025, 06:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-03-04 06:15
Updated : 2025-05-14 14:51
NVD link : CVE-2024-13685
Mitre link : CVE-2024-13685
CVE.ORG link : CVE-2024-13685
JSON object : View
Products Affected
wpase
- admin_and_site_enhancements
CWE
CWE-290
Authentication Bypass by Spoofing