Miniorange Web Application Firewall vulnerabilities

2 CVEs affecting Miniorange Web Application Firewall, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-4539, published 2024-08-31.

More from Miniorange.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2024-2172, published 2024-03-13. Critical severity, CVSS 9.8. EPSS: 1.7% chance of exploitation in the next 30 days. The Malware Scanner plugin and the Web Application Firewall plugin for WordPress (both by MiniOrange) are vulnerable to privilege escalation due to a missing capability check on the mo_wpns_init()…
• CVE-2022-4539, published 2024-08-31. Medium severity, CVSS 5.3. EPSS: 0.6% chance of exploitation in the next 30 days. The Web Application Firewall plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.1.2. This is due to insufficient restrictions on where the IP Address…