SecuPress Free <= 2.7.2 - Unauthenticated IP Allowlist Bypass via IPv6 CIDR Range Matching
- ID
- WPSEC-2026-1535
- Plugin
- SecuPress with Simple SSL – Simple and Performant Security (secupress)
- Affected
- all versions before 2.7.3
- Remediation
- Update to 2.7.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-1023
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-23
- Attack surface
- SecuPress Free on WPSec AttackSurface
- Fix released
- Published
Description
The SecuPress with Simple SSL plugin for WordPress is vulnerable to an IP allowlist bypass via IPv6 CIDR range matching in all versions up to, and including, 2.7.2. The cause is an incorrect comparison in the secupress_is_ip_in_range() function. It overwrites the prefix mask inside its loop and returns a match as soon as any one 16-bit group within the prefix matches, instead of requiring the whole prefix to match. The plugin's built-in allowlist always contains IPv6 CIDR entries such as 2001:4860::/32, 2a00:1450::/29, 2607:f8b0::/32 and 2a02:2350:4:200::/55, so any address that shares a single group with one of them (for example any 2001::/16 address) counts as allowlisted. This makes it possible for unauthenticated attackers with such an IPv6 address to skip IP bans, the Limit Login Attempts protection, the firewall and other IP-based protections. In 2.7.2 the same flaw also caused such addresses to be trusted as Cloudflare proxies, so their CF-Connecting-IP header was accepted as the client IP.
References
- https://wpsec.com/vuln/WPSEC-2026-1535/
- https://plugins.svn.wordpress.org/secupress/tags/2.7.3/
- https://wordpress.org/plugins/secupress/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS