WordPress CVEs

Description

The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection plugin for WordPress is vulnerable to unauthorized access of data due to an insufficient capability check on the 'stopbadbots_check_wordpress_logged_in_cookie' function in all versions up to, and including, 11.58. This makes it possible for unauthenticated attackers to bypass blocklists, rate limits, and other plugin functionality.

Affected WordPress components

• stopbadbots Plugin · stopbadbots
  Confirmed match Homeless
  Up to and including 11.58
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• sminozzi Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection — Up to and including 11.58

References

• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/stopbadbots/trunk/stopbadbots.php#L1958
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3350927/
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3351023/
• www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/8d6b0d86-3cb4-4723-b677-141c604f00cc?source=cve
• nvd.nist.gov Official NVD record