What is the CVSS score of CVE-2026-8616?

CVE-2026-8616 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Fense Proxy VPN Blocker CVE-2026-8616

EUVD-2026-45126 MEDIUM

Missing Authorization (CWE-862)

2026-07-17 Wordfence

GHSA-56hc-jghx-566j

WordPress Authentication Bypass Wordpress Plugin Fense Proxy Vpn Blocker

5.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

AV:N and PR:N confirmed by wp_ajax_nopriv_* registration; I:L for option/transient deletion only; no code execution, credential exposure, or persistent unavailability.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 17, 2026 - 04:21 vuln.today

CVE Published

Jul 17, 2026 - 02:31 cve.org

MEDIUM 5.3

DescriptionCVE.org

The Fense Proxy & VPN Blocker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce validation on the fense_bpvt_save_settings() function in versions up to, and including, 3.0.1. The callback is registered to both wp_ajax_* and wp_ajax_nopriv_* hooks and unconditionally calls delete_option() on four plugin options and delete_transient() on three transients tied to the plugin's API key cache and settings. This makes it possible for unauthenticated attackers to delete plugin options and transients, effectively resetting the plugin's API key/data cache and forcing the plugin to refetch state.

AnalysisAI

Unauthenticated settings reset in the Fense Proxy & VPN Blocker WordPress plugin (versions up to and including 3.0.1) allows any remote attacker to wipe the plugin's API key cache and configuration by invoking an unprotected AJAX endpoint. The fense_bpvt_save_settings() function is registered to both wp_ajax_* and wp_ajax_nopriv_* hooks without any capability check or nonce validation, meaning it is reachable without authentication and calls delete_option() and delete_transient() unconditionally on plugin-critical data. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the attack is trivial to execute and carries a meaningful functional consequence: disabling the site's VPN and proxy detection capability.

Technical ContextAI

The root cause is CWE-862 (Missing Authorization) compounded by missing nonce validation, both within a WordPress AJAX callback. In WordPress, registering an action on wp_ajax_nopriv_* exposes it to unauthenticated HTTP clients via wp-admin/admin-ajax.php. The affected function fense_bpvt_save_settings() omits both a current_user_can() capability check and wp_verify_nonce() verification, which are the two standard WordPress authorization gates for AJAX handlers. The function then unconditionally invokes WordPress's delete_option() on four plugin options and delete_transient() on three transients that hold the plugin's API key and cached state. The vulnerable code is visible in the plugin repository at tags/2.9.0/includes/system/fense-bpvt-header-code.php (lines 32 and 48), with the fix applied in tags/3.0.2. The affected product is identified by CPE cpe:2.3:a:devozon:fense_proxy_&_vpn_blocker:*:*:*:*:*:*:*:* for versions up to and including 3.0.1.

RemediationAI

Update the Fense Proxy & VPN Blocker plugin to version 3.0.2 or later, which introduces the corrected AJAX handler as confirmed by the WordPress plugin repository at https://plugins.trac.wordpress.org/browser/fense-block-vpn-proxy/tags/3.0.2/includes/system/header-code.php. If an immediate update is not feasible, a compensating control is to disable the plugin temporarily and enforce VPN and proxy blocking at the server or WAF layer - for example, using a hosting-level IP reputation list or Cloudflare's bot management rules - to maintain blocking coverage during the maintenance window. Note that disabling the plugin removes all WordPress-layer VPN detection. Administrators relying on this plugin for access control should treat any gap in coverage as a security exposure and prioritize patching. Full advisory detail is at https://www.wordfence.com/threat-intel/vulnerabilities/id/1208ac78-4a56-4daa-b935-d579f07f8e8e.