# Security Ninja – WordPress Security & Firewall <= 5.303 - Unauthenticated Firewall Bypass via Empty Secret Access URL Token

- **ID:** WPSEC-2026-0945
- **Plugin:** Security Ninja – WordPress Security & Firewall (`security-ninja`), https://wordpress.org/plugins/security-ninja/
- **Affected versions:** from 5.263 before 5.305
- **Fixed in:** 5.305 (Update to 5.305 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-287
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/security-ninja
- **Fix released:** 2026-10-12
- **Published:** 2026-10-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0945/

## Description

The Security Ninja plugin for WordPress is vulnerable to Firewall Bypass via the secret access URL ('snf' parameter) in versions 5.263 to 5.303. This is due to the do_init_action() function comparing the 'snf' value to the stored unblock token with a strict equality check while that token is still an empty string, which it is until an administrator opens the Firewall page with the firewall active or requests the access link by email; enabling the firewall from the setup wizard does not create it. This makes it possible for unauthenticated attackers to add their own IP address to the firewall whitelist by sending an empty 'snf' parameter, exempting it from the plugin's IP and country bans. The check runs before the firewall's on/off check, so an IP whitelisted while the firewall is off stays whitelisted once it is enabled.

## References

- https://wpsec.com/vuln/WPSEC-2026-0945/
- https://plugins.svn.wordpress.org/security-ninja/tags/5.305/
- https://wordpress.org/plugins/security-ninja/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0945/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.