What the vulnerability does
01Description
The Fense Proxy & VPN Blocker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce validation on the fense_bpvt_save_settings() function in versions up to, and including, 3.0.1. The callback is registered to both wp_ajax_* and wp_ajax_nopriv_* hooks and unconditionally calls delete_option() on four plugin options and delete_transient() on three transients tied to the plugin's API key cache and settings. This makes it possible for unauthenticated attackers to delete plugin options and transients, effectively resetting the plugin's API key/data cache and forcing the plugin to refetch state.
Explanation of Vulnerability in Simple Terms
02Summary
Fense Proxy & VPN Blocker versions 3.0.1 and earlier lack proper authorization checks, allowing unauthenticated attackers to modify data on the application. The vulnerability requires only network access and no user interaction. Site administrators should update to a version newer than 3.0.1 as soon as available.
What an attacker can do
03Attacker Capabilities
Modify application data without authentication.
Potential impact on your site
04Site Impact
Unauthorized users can alter application settings or data without logging in.
Conditions required to exploit
05Prerequisites
Network access to the application; no authentication or user interaction required.
Key dates
06Disclosure timeline
July 17, 2026
CVE published
July 21, 2026
Record updated
