Security & Malware scan by CleanTalk <= 2.189 - Unauthenticated Rate Limit Bypass via User-Agent Header
- ID
- WPSEC-2026-1008
- Plugin
- Security Plugin, Firewall & Malware Scanner with Auto Removal (security-malware-firewall)
- Affected
- from 2.176 before 2.190
- Remediation
- Update to 2.190 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-307
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-15
- Attack surface
- Security & Malware scan by CleanTalk on WPSec AttackSurface
- Fix released
- Published
Description
The Security Plugin, Firewall & Malware Scanner with Auto Removal plugin for WordPress is vulnerable to a rate limit bypass via the User-Agent header in all versions up to, and including, 2.189, due to the plugin's rate limiter building its counter key from the client-supplied User-Agent header together with the IP address, and updating the counter non-atomically. This makes it possible for unauthenticated attackers to evade the plugin's request rate limits, including the limits on two-factor authentication code submissions and the leaked-password change form, by sending a different User-Agent with each request. This weakens the plugin's brute-force protection.
References
- https://wpsec.com/vuln/WPSEC-2026-1008/
- https://plugins.svn.wordpress.org/security-malware-firewall/tags/2.190/
- https://wordpress.org/plugins/security-malware-firewall/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS