What’s Vulnerable › Vulnerabilities
CVE-2024-13685: Admin and Site Enhancements (ASE) < 7.6.10 - Limit Login Attempt Bypass via IP Spoofing
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2025-03-04 · updated 2026-06-17
- Weakness: CWE-290
Description
The Admin and Site Enhancements (ASE) WordPress plugin before 7.6.10 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate their value to bypass the login limit feature in the Admin and Site Enhancements (ASE) WordPress plugin before 7.6.10.
Affected products
- Admin and Site Enhancements (ASE): before 7.6.10 — fixed in 7.6.10
How to fix
Upgrade to a fixed version: Admin and Site Enhancements (ASE) 7.6.10. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2024-13685 or the next vulnerability affects your stack