{
 "id": "WPSEC-2026-0945",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0945/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0945/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0945/index.md",
 "title": "Security Ninja – WordPress Security & Firewall <= 5.303 - Unauthenticated Firewall Bypass via Empty Secret Access URL Token",
 "description": "The Security Ninja plugin for WordPress is vulnerable to Firewall Bypass via the secret access URL ('snf' parameter) in versions 5.263 to 5.303. This is due to the do_init_action() function comparing the 'snf' value to the stored unblock token with a strict equality check while that token is still an empty string, which it is until an administrator opens the Firewall page with the firewall active or requests the access link by email; enabling the firewall from the setup wizard does not create it. This makes it possible for unauthenticated attackers to add their own IP address to the firewall whitelist by sending an empty 'snf' parameter, exempting it from the plugin's IP and country bans. The check runs before the firewall's on/off check, so an IP whitelisted while the firewall is off stays whitelisted once it is enabled.",
 "plugin": {
  "slug": "security-ninja",
  "name": "Security Ninja – WordPress Security & Firewall",
  "full_name": "Security Ninja – WordPress Security & Firewall",
  "wordpress_org": "https://wordpress.org/plugins/security-ninja/",
  "advisories_url": "https://wpsec.com/vuln/plugin/security-ninja/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/security-ninja"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-287"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "5.263",
    "from_inclusive": true,
    "to": "5.305",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 5.263 before 5.305"
  ]
 },
 "introduced_in": "5.263",
 "fixed_in": "5.305",
 "remediation": "Update to 5.305 or later.",
 "fix_released": "2026-10-12T22:14:24+00:00",
 "published": "2026-10-14T13:49:25+00:00",
 "updated": "2026-10-14T13:20:04.147565+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0945/",
  "https://plugins.svn.wordpress.org/security-ninja/tags/5.305/",
  "https://wordpress.org/plugins/security-ninja/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/security-ninja",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-14"
 }
}