Junglewise Threat Intelligence

CVE-2026-8616: Devozon Fense Proxy & VPN Blocker unauthorized data modification

CVE-2026-8616 · Severity: medium · CVSS 5.3 · Published 2026-07-17

Executive brief

The Fense Proxy & VPN Blocker plugin for WordPress, which helps websites block unwanted traffic from proxies and VPNs, contains a security flaw that allows unauthorized users to reset its settings. An attacker can remotely clear the plugin's API keys and cached data without needing a password. This could disrupt the plugin's ability to filter traffic and force it to re-authenticate with its service provider, potentially leading to service interruptions or increased operational costs.

Technical details

The vulnerability is classified as Missing Authorization (CWE-862) within the fense_bpvt_save_settings() function. The function is registered to both wp_ajax_* and wp_ajax_nopriv_* hooks, making it accessible to unauthenticated users. Because the function lacks both capability checks and nonce validation, an attacker can trigger the unconditional execution of delete_option() and delete_transient() on specific plugin settings and API key caches. This allows an unauthenticated attacker to reset the plugin's state and force a refetch of API data. The issue is addressed in version 3.0.2.

Affected products

  • devozon Fense Proxy & VPN Blocker up to, and including, 3.0.1

Timeline

  • 2026-07-17: advisory: NVD publication date
  • 2026-07-17: disclosed: Wordfence advisory published

References