wpDiscuz IP Spoofing Vulnerability Allowing Bypass of Rate Limiting and Ban Enforcement

An IP spoofing vulnerability has been identified in the wpDiscuz WordPress plugin, affecting versions prior to 7.6.47. The issue resides in the getIP() function, where the plugin trusts untrusted HTTP headers, allowing attackers to spoof their IP addresses. By manipulating the HTTP_CLIENT_IP or HTTP_X_FORWARDED_FOR headers, attackers can bypass IP-based rate limiting and ban enforcement, circumventing essential security controls.

Impact

Exploitation of this vulnerability allows for IP spoofing, which can be used to bypass rate limiting and ban enforcement mechanisms, potentially leading to abuse of commenting features or other rate-limited actions.