CVE-2024-0789: 
WordPress vulnerability analysis and mitigation

The WP Maintenance plugin for WordPress contains a vulnerability identified as CVE-2024-0789, discovered and reported by researcher Hoa Le Ngoc. The vulnerability affects all versions up to and including 6.1.9.2, and was publicly disclosed on June 18, 2024. This security issue involves IP Address Spoofing due to insufficient validation mechanisms in the plugin (CVE Mitre, NVD).

The vulnerability stems from insufficient IP address validation and the plugin's reliance on user-supplied HTTP headers as the primary method for IP address retrieval. The issue has been assigned a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating network accessibility, low attack complexity, and no required privileges or user interaction (NVD).

The primary impact of this vulnerability is that it allows unauthenticated attackers to bypass the maintenance mode of the website. This could potentially expose content or functionality that should be restricted during maintenance periods (CVE Mitre).

Website administrators running the WP Maintenance plugin should update to a version newer than 6.1.9.2 if available. The vulnerability has been reported and documented in the WordPress plugin repository, indicating that a fix may be available in newer versions (NVD).