WordPress IP Blocker Lite Plugin <= 11.1.1 is vulnerable to Cross Site Request Forgery (CSRF)

Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability exists in the LionScripts IP Blocker Lite plugin for WordPress, affecting versions up to and including 11.1.1. The plugin lacks proper CSRF protection on certain actions, allowing attackers to trick authenticated users into performing unintended operations.

Exploitation

An attacker can craft a malicious web page or email that, when visited by an authenticated WordPress administrator, triggers a forged request to the plugin’s endpoints. No special authentication or network position is required beyond the ability to serve content to the victim or entice them to click a link.

Impact

Successful exploitation enables an attacker to perform actions on the WordPress site within the context of the victim’s session, such as modifying IP block rules, disabling security configurations, or adding/removing blocked addresses. This could lead to reduced site security and potential exposure of administrative functionality to unauthorized parties.

Mitigation

The plugin has been closed and removed from the WordPress.org plugin directory as of July 27, 2023, due to a security issue [1]. No patched version is available through official channels. Users should immediately uninstall the plugin and consider alternative security solutions.