CVE-2026-8616: Fense Proxy VPN Blocker Auth Bypass Flaw

CVE-2026-8616 Overview

CVE-2026-8616 affects the Fense Proxy & VPN Blocker plugin for WordPress in versions up to and including 3.0.1. The plugin exposes the fense_bpvt_save_settings() AJAX callback through both wp_ajax_* and wp_ajax_nopriv_* hooks without a capability check or nonce validation. Unauthenticated attackers can invoke the endpoint to call delete_option() on four plugin options and delete_transient() on three transients tied to the plugin's API key cache and settings. The result is unauthorized modification of plugin state and forced re-fetching of configuration data.

Critical Impact
Unauthenticated network attackers can reset plugin configuration and API key caches, degrading the plugin's proxy and VPN blocking function [CWE-862].

Affected Products

Fense Proxy & VPN Blocker plugin for WordPress, versions ≤ 3.0.1
Fixed in version 3.0.2 (header-code.php revision 3574545)
WordPress sites running the vulnerable plugin with AJAX endpoints reachable over the network

Discovery Timeline

2026-07-17 - CVE-2026-8616 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-8616

Vulnerability Analysis

The vulnerability resides in the fense_bpvt_save_settings() function within the plugin's header-code handler. The function is registered as an AJAX action for both authenticated and unauthenticated users through the wp_ajax_fense_bpvt_save_settings and wp_ajax_nopriv_fense_bpvt_save_settings hooks. When invoked, it unconditionally calls delete_option() against four plugin options and delete_transient() against three transients used for the plugin's API key cache and settings state.

Because the handler performs no current_user_can() capability check and does not validate a WordPress nonce with check_ajax_referer() or wp_verify_nonce(), any anonymous HTTP request to /wp-admin/admin-ajax.php with the corresponding action parameter triggers the deletion logic. This maps to Missing Authorization [CWE-862].

Root Cause

The root cause is a broken access control pattern. The developer registered a state-changing action on the unauthenticated AJAX hook (wp_ajax_nopriv_*) and omitted both authorization enforcement and CSRF protection. Any code path that mutates persistent site state must verify caller identity and request intent, which this handler does not do.

Attack Vector

An attacker sends a crafted POST or GET request to admin-ajax.php with the plugin's save-settings action name. No authentication, session, or user interaction is required. The plugin then deletes the referenced options and transients, clearing the API key cache and forcing the plugin to refetch state on the next request. Repeated invocation can be used to keep the plugin's configuration in a reset condition.

See the Wordfence Vulnerability Report and the WordPress Plugin Update Code for the fixed implementation.

Detection Methods for CVE-2026-8616

Indicators of Compromise

Unauthenticated POST or GET requests to /wp-admin/admin-ajax.php containing action=fense_bpvt_save_settings
Plugin options and transients tied to fense-block-vpn-proxy disappearing without administrator activity
Repeated outbound API key refresh calls from the plugin following unexpected cache invalidation

Detection Strategies

Alert on HTTP requests to admin-ajax.php where the action parameter matches the vulnerable handler and no authenticated WordPress session cookie is present
Correlate WordPress options and transients deletion events with the source IP of AJAX requests via database or plugin audit logs
Deploy a Web Application Firewall (WAF) rule to flag or block anonymous invocations of the fense_bpvt_save_settings action

Monitoring Recommendations

Monitor WordPress wp_options and wp_transients tables for unexpected deletions tied to plugin keys
Log all admin-ajax.php calls with client IP, user agent, and referer for post-incident analysis
Track version inventory of the Fense Proxy & VPN Blocker plugin across managed WordPress sites

How to Mitigate CVE-2026-8616

Immediate Actions Required

Update the Fense Proxy & VPN Blocker plugin to version 3.0.2 or later on every affected WordPress site
Audit admin-ajax.php access logs for prior invocations of action=fense_bpvt_save_settings from unauthenticated sources
Re-enter and validate the plugin's API key and settings after upgrading to restore expected state

Patch Information

The vendor addressed the issue in version 3.0.2. The fixed handler is available in the plugin's repository at WordPress Plugin Update Code. The patched code adds authorization and nonce validation before mutating plugin options and transients.

Workarounds

If immediate patching is not possible, disable and remove the Fense Proxy & VPN Blocker plugin until it can be updated
Add a WAF or reverse proxy rule to reject unauthenticated requests to admin-ajax.php where action=fense_bpvt_save_settings
Restrict access to /wp-admin/admin-ajax.php from untrusted networks where the site's function permits

bash

# Example nginx rule to block anonymous invocations of the vulnerable action
location = /wp-admin/admin-ajax.php {
    if ($arg_action = "fense_bpvt_save_settings") {
        return 403;
    }
    # existing PHP handling below
}