CVE-2024-30522: 
WordPress vulnerability analysis and mitigation

The Newsletter WordPress plugin, developed by Stefano Lissa & The Newsletter Team, contains an Authentication Bypass by Spoofing vulnerability affecting versions up to 8.2.0. The vulnerability was discovered on March 28, 2024, and allows unauthenticated attackers to bypass the IP blocklist functionality through IP address spoofing (WPScan, Patchstack).

The vulnerability is classified as CWE-290 (Authentication Bypass by Spoofing) and has been assigned a CVSS v3.1 score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. The issue stems from insufficient IP address validation in the plugin, which makes it possible for unauthenticated attackers to spoof their IP address (Patchstack).

The vulnerability allows attackers to bypass the plugin's IP blocklist protection mechanism. While the direct impact is limited to bypassing IP-based restrictions, this could potentially lead to unauthorized access to functionality that should be restricted (WPScan).

The vulnerability can be exploited by unauthenticated attackers and requires low attack complexity. No user interaction is needed for exploitation, making it relatively straightforward to exploit (Patchstack).

The vulnerability has been fixed in version 8.2.1 of the Newsletter plugin. Users are advised to update to this version or later to resolve the security issue (Patchstack).