WordPress: Nicepage plugin import failed

Description

To reproduce this error

Here is the process

1. Install Nicepage plugin (https://nicepage.com/doc/1323/getting-started-with-wp-theme-and-plugin).
2. In the WordPress sidebar, go to Nicepage > Import
3. When uploading a zip file (while choosing check replace & replace)
4. Finally after hitting upload we get 403 error.

---lDPfp6Zx---H--
ModSecurity: Warning. Matched "Operator `Within' with parameter `/proxy/ /lock-token/ /content-range/ /if/' against variable `TX:header_name_content-range' (Value: `/content-range/' ) [file "/usr/local/lsws/conf/modsec/coreruleset-3.3.2/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1087"] [id "920450"] [rev ""] [msg "HTTP header is restricted by policy (/content-range/)"] [data "Restricted header detected: /content-range/"] [severity "2"] [ver "OWASP_CRS/3.3.2"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "domain.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "1637483735"] [ref "o0,13v1742,13t:lowercaseo0,16v1781,16t:lowercaseo0,7v1574,7t:lowercaseo0,4v1546,4t:lowercaseo0,10v1647,10t:lowercaseo0,14v1927,14t:lowercaseo0,6v266,6t:lowercaseo0,15v74,15t:lowercaseo0,12v141,12t:low (170 characters omitted)"]
ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:ANOMALY_SCORE' (Value: `5' ) [file "/usr/local/lsws/conf/modsec/coreruleset-3.3.2/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "80"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "2"] [ver "OWASP_CRS/3.3.2"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "domain.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "1637483735"] [ref ""]

---lDPfp6Zx---Z--

Audit Logs / Triggered Rule Numbers

id “949110”

Seems this one is creating an issue -> https://github.com/coreruleset/coreruleset/blob/4eab4128a7079551551dcea90e1910ce7946d4eb/rules/REQUEST-949-BLOCKING-EVALUATION.conf#L139

Your Environment

• CRS version (e.g., v3.2.2):
• Paranoia level setting:
• ModSecurity version (e.g., 2.9.3):
• Web Server and version (e.g., apache 2.4.41): OpenLiteSpeed/LiteSpeed Enterprise
• Operating System and version: Ubuntu 20.04

Confirmation

[ ] I have removed any personal data (email addresses, IP addresses, passwords, domain names) from any logs posted.

[usmannasir]

@airween This seems to resolve the issue.

[usmannasir]

I will try this and revert to you by tomorrow.