Subscriber Bypass in All In One WP Security & Firewall

Executive Summary

This is a subscriber bypass vulnerability in the All In One WP Security & Firewall WordPress plugin versions 5.4.8 and below. It allows attackers with low privileges, such as a Subscriber role, to bypass security checks as if they were not active.

Useful 0 Not Useful 0

Detection Guidance

Check if the All In One WP Security & Firewall plugin version is 5.4.8 or below. Use WordPress admin dashboard or run: wp plugin list --name=all-in-one-wp-security-and-firewall. If vulnerable, update to version 5.4.9 or later.

Useful 0 Not Useful 0

Impact Analysis

Attackers could exploit this to bypass security measures in the plugin, potentially gaining unauthorized access or performing actions restricted by the plugin's security features. The impact is limited due to low severity and requires only low-privilege access.

Useful 0 Not Useful 0

Mitigation Strategies

Update the All In One WP Security & Firewall plugin to version 5.4.9 or later immediately. Enable auto-updates for the plugin if available. Review user roles to ensure no unauthorized Subscriber-level access exists.

Useful 0 Not Useful 0