Description

The Security Optimizer WordPress plugin from 1.5.8 to 1.6.4 does not correctly validate requests to its optional IP-based login restriction feature, allowing the restriction to be bypassed so that unauthenticated requests from non-allowlisted IP addresses can reach and use the login form, defeating the access control the administrator configured.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-06T22:16:45.583Z",
  "pubdate": "2026-08-06T22:16:45.583Z",
  "executiveSummary": "An access control bypass vulnerability exists within the Security Optimizer WordPress plugin affecting versions 1.5.8 to 1.6.4. The vulnerability stems from improper request validation within the optional IP-based login restriction feature, which fails to correctly enforce administrative access control policies.\nThe flaw allows unauthenticated remote attackers originating from non-allowlisted IP addresses to completely bypass the configured IP restriction mechanism. Successful exploitation enables unauthorized requests to successfully reach and interact with the underlying login form, effectively neutralizing the security boundary established by the site administrator.\nWhile this does not grant direct administrative access on its own, it removes a critical layer of defense-in-depth, exposing the authentication endpoint to brute-force attacks, credential stuffing, and automated exploitation attempts from prohibited network locations.\nExploitation requires network access to the target WordPress login endpoint, but no prior authentication or specific privileges are required. Mitigation requires updating the Security Optimizer plugin to a patched version once available or temporarily disabling the affected IP-based login restriction feature.",
  "technicalDetails": "The vulnerability resides in the optional IP-based login restriction feature of the Security Optimizer WordPress plugin, spanning versions 1.5.8 through 1.6.4. The root cause of the security defect is insufficient and improper request validation logic governing how incoming HTTP requests are evaluated against the administrator-configured IP allowlist.\nWhen a client initiates a connection to the WordPress login interface, the plugin is expected to intercept the request, extract the origin IP address, and compare it against the defined allowlist rules. Due to improper validation, the mechanism fails to reliably enforce these constraints, allowing requests originating from unauthenticated, non-allowlisted IP addresses to traverse the restriction check unhindered.\nThe attack flow proceeds as follows: an attacker operating from a prohibited external IP address sends an HTTP GET or POST request directly to the authentication endpoint (e.g., wp-login.php). Rather than dropping the request or returning an HTTP 403 Forbidden status code as intended by the administrator's security policy, the vulnerable component incorrectly validates the request context and permits the transaction to proceed.\nThis behavior exposes the underlying login form to actors who should otherwise be blocked entirely at the perimeter. The attack vector is strictly network-based, exposing the application over standard HTTP/HTTPS protocols without requiring any authentication credentials, prior access, or elevated privileges.\nThe post-exploitation impact degrades the overall security posture of the affected WordPress instance. By neutralizing the IP-based access control restriction, the vulnerability facilitates automated credential stuffing campaigns, targeted brute-force attacks against user accounts, and potential exploitation of secondary vulnerabilities residing within the login mechanism itself."
}