The WordPress plugin WP Real IP-based Access Control versions up to and including 1.3.1 fails to check user capabilities or verify a security nonce before storing a particular option value. The plugin also does not escape this value when rendering its settings page. As a result, unauthenticated users can persist arbitrary JavaScript that will run whenever an administrator visits the settings page. Attackers could hijack admin sessions, deface the site, or perform further privilege‑escalating actions through the compromised administrator context.

All installations of the WP Real IP-based Access Control plugin whose version is 1.3.1 or earlier are affected. No additional affected products were identified.

The vulnerability carries a CVSS score of 6.1, indicating moderate severity. The EPSS score is less than 1 %, suggesting a low likelihood of exploitation. The flaw is not listed in the CISA KEV catalog. Exploitation requires the attacker to submit a payload that the plugin stores in an option, and then rely on an administrator to view the settings page where the unsanitized script will run. Because no authentication or nonce checks are performed, the attack can be carried out against any public site that hosts the vulnerable plugin.