WP Real IP Plugin CVE-2026-14592

The WP Real IP-based Access Control plugin must be installed and active on the target WordPress site at version 1.3.1 or earlier. No authentication is required for the injection phase - any network-reachable client can POST the malicious payload. Exploitation of the stored payload requires an administrator to visit the plugin's settings page after injection, which may occur naturally during routine administration or be induced via social engineering. The attack is not automatable at scale because of this required administrator interaction (SSVC Automatable: no). Sites that restrict wp-admin access by IP or require VPN for admin access significantly reduce exposure. No specific non-default configuration is required - the vulnerability is present in the plugin's default installation state.

The CVSS 3.1 score of 6.1 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:C reflects a realistic characterization: the injection phase requires no authentication and no complexity, but payload delivery to the victim administrator requires that person to navigate to the settings page (UI:R). The scope change (S:C) acknowledges that the XSS executes in the administrator's browser context rather than the plugin's own execution environment, enabling session hijacking or privileged action execution. The EPSS score of 0.19% at the 9th percentile indicates low modeled exploitation probability across the broader internet, and the absence from CISA KEV confirms no confirmed threat-actor adoption at time of analysis. SSVC signals reinforce this: exploitation status is 'poc' (not active), automatable is 'no' (the UI:R step prevents fully automated mass exploitation), and technical impact is 'partial'. Overall, this is a real but limited-scope threat - meaningful for any site running the affected plugin where an attacker can reliably get an admin to visit the settings page (e.g., via social engineering or post-phishing), but not a mass-exploitation risk based on current signals.

An unauthenticated attacker identifies a WordPress site running WP Real IP-based Access Control ≤ 1.3.1 and sends a crafted HTTP POST request to the plugin's option-storing endpoint embedding a JavaScript payload (e.g., a cookie-stealer or admin action script) in the relevant parameter. Because no nonce or capability check is performed, the payload is written directly to the WordPress options table. When a site administrator next navigates to the plugin's settings page - whether through routine administration or after being lured there - the stored script executes in their browser, potentially exfiltrating the admin's session cookie or silently creating a rogue administrator account. A publicly available proof-of-concept demonstrates this injection path.