Medium severity5.3NVD Advisory· Published Jun 19, 2024· Updated Apr 15, 2026

CVE-2024-0789

Description

The WP Maintenance plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 6.1.9.2 due to insufficient IP address validation and use of user-supplied HTTP headers as a primary method for IP retrieval. This makes it possible for unauthenticated attackers to bypass maintenance mode.

Affected products

WordPress/Wp Maintenanceinferred2 versions
<=6.1.9.2+ 1 more
- (no CPE)range: <=6.1.9.2
- (no CPE)range: <=6.1.9.2
Package: https://wordpress.org/plugins/wp-maintenance

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/changesetnvd
www.wordfence.com/threat-intel/vulnerabilities/id/8f6bbaa1-c50f-4dad-9e5b-04bdffd4a0aenvd

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000