What’s Vulnerable › Vulnerabilities

CVE-2022-4097: All In One WP Security & Firewall < 5.0.8 - IP Spoofing

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-12-12 · updated 2026-06-17
• Weakness: CWE-639

Description

The All-In-One Security (AIOS) WordPress plugin before 5.0.8 is susceptible to IP Spoofing attacks, which can lead to bypassed security features (like IP blocks, rate limiting, brute force protection, and more).

Affected products

• All-In-One Security (AIOS): before 5.0.8 — fixed in 5.0.8

How to fix

Upgrade to a fixed version: All-In-One Security (AIOS) 5.0.8. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/15819d33-7497-4f7d-bbb8-b3ab147806c4
• https://wpscan.com/vulnerability/15819d33-7497-4f7d-bbb8-b3ab147806c4

Get alerted when CVE-2022-4097 or the next vulnerability affects your stack