CVE-2026-8616 Details
Description
The Fense Proxy & VPN Blocker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce validation on the fense_bpvt_save_settings() function in versions up to, and including, 3.0.1. The callback is registered to both wp_ajax_* and wp_ajax_nopriv_* hooks and unconditionally calls delete_option() on four plugin options and delete_transient() on three transients tied to the plugin's API key cache and settings. This makes it possible for unauthenticated attackers to delete plugin options and transients, effectively resetting the plugin's API key/data cache and forcing the plugin to refetch state.
A vulnerability exists in the Fense Proxy & VPN Blocker plugin for WordPress, specifically in versions 3.0.1 and prior. The issue arises from a lack of proper capability checks and nonce validation in the 'fense_bpvt_save_settings()' function. This function, which is hooked to both 'wp_ajax_*' and 'wp_ajax_nopriv_*' actions, unconditionally deletes four plugin options and three transients related to the plugin's API key cache and settings. As a result, unauthenticated attackers can exploit this vulnerability to remove critical plugin data, forcing the plugin to retrieve its state anew.
Users are advised to update the Fense Proxy & VPN Blocker plugin to version 3.0.2 or a later patched version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 17, 2026CISA-ADP
Assessed Jul 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Fense Proxy & VPN Blocker | <= 3.0.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | CVE Modified | CISA-ADP |
| Jul 17, 2026 | New CVE Received | [email protected] |