Security Ninja – WordPress Security & Firewall <= 5.303 - Unauthenticated Firewall Bypass via Empty Secret Access URL Token
- ID
- WPSEC-2026-0945
- Plugin
- Security Ninja – WordPress Security & Firewall (security-ninja)
- Affected
- from 5.263 before 5.305
- Remediation
- Update to 5.305 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-287
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-14
- Attack surface
- Security Ninja – WordPress Security & Firewall on WPSec AttackSurface
- Fix released
- Published
Description
The Security Ninja plugin for WordPress is vulnerable to Firewall Bypass via the secret access URL ('snf' parameter) in versions 5.263 to 5.303. This is due to the do_init_action() function comparing the 'snf' value to the stored unblock token with a strict equality check while that token is still an empty string, which it is until an administrator opens the Firewall page with the firewall active or requests the access link by email; enabling the firewall from the setup wizard does not create it. This makes it possible for unauthenticated attackers to add their own IP address to the firewall whitelist by sending an empty 'snf' parameter, exempting it from the plugin's IP and country bans. The check runs before the firewall's on/off check, so an IP whitelisted while the firewall is off stays whitelisted once it is enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-0945/
- https://plugins.svn.wordpress.org/security-ninja/tags/5.305/
- https://wordpress.org/plugins/security-ninja/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS