CVE-2022-4097: medium-severity vulnerability in All-In-One Security (AIOS)
All In One WP Security & Firewall < 5.0.8 - IP Spoofing
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.6%
The All-In-One Security (AIOS) WordPress plugin before 5.0.8 is susceptible to IP Spoofing attacks, which can lead to bypassed security features (like IP blocks, rate limiting, brute force protection, and more).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
Unknown · All-In-One Security (AIOS)Related CVEs — All-In-One Security (AIOS)
In the same product, most dangerous first.
CVE-2023-0157MEDIUMAll-In-One Security (AIOS) < 5.1.5 - Admin+ Stored XSSEPSS 32.5%CVE-2023-0156MEDIUMAll-In-One Security (AIOS) < 5.1.5 - Admin+ Arbitrary File/Folder Access via TraversalEPSS 19.9%CVE-2022-4346MEDIUMAll In One WP Security & Firewall < 5.1.3 - Configuration LeakEPSS 0.7%CVE-2026-111739HIGHTwo Factor Authentication < 1.17.0 and All-In-One Security (AIOS) < 5.5.0 - Subscriber+ 2FA Bypass via 'creds_user_id' ParameterEPSS 0.3%