PT-2026-60705 · Devozon · Fense Proxy & Vpn Blocker

Legion Hunter · CVE-2026-8616 · Published 2026-07-17 · Updated 2026-07-17

Mitre

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

The Fense Proxy & VPN Blocker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce validation on the fense bpvt save settings() function in versions up to, and including, 3.0.1. The callback is registered to both wp ajax * and wp ajax nopriv * hooks and unconditionally calls delete option() on four plugin options and delete transient() on three transients tied to the plugin's API key cache and settings. This makes it possible for unauthenticated attackers to delete plugin options and transients, effectively resetting the plugin's API key/data cache and forcing the plugin to refetch state.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-8616

Affected Products

Fense Proxy & Vpn Blocker

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-8616 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/1208ac78-4a56-4daa-b935-d579f07f8e8e?source=cve · Note
• https://plugins.trac.wordpress.org/browser/fense-block-vpn-proxy/tags/2.9.0/includes/system/fense-bpvt-header-code.php#L48 · Note
• https://plugins.trac.wordpress.org/browser/fense-block-vpn-proxy/tags/2.9.0/includes/system/fense-bpvt-header-code.php#L32 · Note
• https://plugins.trac.wordpress.org/browser/fense-block-vpn-proxy/tags/3.0.2/includes/system/header-code.php?rev=3574545 · Note