CVE-2022-1601: Alexanderschneider User Access Manager

Medium severity, CVSS 5.3. EPSS: 0.6% chance of exploitation in the next 30 days.

The User Access Manager WordPress plugin before 2.2.18 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible for attackers to access restricted content in certain situations.

Affected products

• Alexanderschneider User Access Manager: before 2.2.18 (fixed in 2.2.18)

Published 2023-08-30. Last modified 2026-06-17.