| @@ -276,19 +276,17 @@ | ||
| 276 | 276 | set_transient( $transient_key, $current_count + 1, $seconds_until_midnight ); |
| 277 | 277 | } |
| 278 | 278 | |
| 279 | 279 | /** |
| 280 | - * Get the client IP address, considering proxy headers. | |
| 280 | + * Get the client IP address. | |
| 281 | 281 | * |
| 282 | + * Uses REMOTE_ADDR only to prevent IP spoofing via X-Forwarded-For headers. | |
| 283 | + * Proxy headers (CF-Connecting-IP, X-Forwarded-For) can be spoofed by clients | |
| 284 | + * when the server is not behind a trusted reverse proxy, allowing attackers | |
| 285 | + * to bypass IP-based rate limits. | |
| 286 | + * | |
| 282 | 287 | * @return string Client IP address |
| 283 | 288 | */ |
| 284 | 289 | protected function get_client_ip() { |
| 285 | - $ip_keys = [ 'HTTP_CF_CONNECTING_IP', 'HTTP_X_FORWARDED_FOR', 'REMOTE_ADDR' ]; | |
| 286 | - foreach ( $ip_keys as $key ) { | |
| 287 | - if ( ! empty( $_SERVER[ $key ] ) ) { | |
| 288 | - $ip = explode( ',', sanitize_text_field( wp_unslash( $_SERVER[ $key ] ) ) )[0]; | |
| 289 | - return trim( $ip ); | |
| 290 | - } | |
| 291 | - } | |
| 292 | - return '0.0.0.0'; | |
| 290 | + return sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ?? '0.0.0.0' ) ); | |
| 293 | 291 | } |
| 294 | 292 | } |
