Vulnerability · Published Sep 4, 2023 · Assigned by WPScan
CVE-2023-4279User Activity Log < 1.6.7 - IP Spoofing
High 7.5
In plain English
A high-severity security flaw in User Activity Log from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.0%top 38.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Public PoC
Official description
This User Activity Log WordPress plugin before 1.6.7 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to hide the source of malicious traffic.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | User Activity Log | 0 – before 1.6.7 |
References
- https://wpscan.com/vulnerability/2bd2579e-b383-4d12-b207-6fc32cfb82bc exploit, vdb-entry, technical-description