CVE-2022-1613: 10up Restricted Site Access

Medium severity, CVSS 5.3. EPSS: 0.7% chance of exploitation in the next 30 days.

The Restricted Site Access WordPress plugin before 7.3.2 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based limitations in certain situations.

Affected products

• 10up Restricted Site Access: before 7.3.2 (fixed in 7.3.2)

Published 2022-09-26. Last modified 2026-06-17.