CVE-2023-4281 - Activity Log < 2.8.8 - IP Spoofing

Back Back to CVE browser

MEDIUM

Activity Log < 2.8.8 - IP Spoofing

Published Sep 25, 2023

5.3

MEDIUM

CVSS 3.1

EPSS 0.72%

Description

This Activity Log WordPress plugin before 2.8.8 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to hide the source of malicious traffic.

Affected products

Vendor n/a Product Activity Log Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <2.8.8

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Activity Log

unaffected

Version	Status	Constraints
0	affected	<2.8.8

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (1)

https://wpscan.com/vulnerability/f5ea6c8a-6b07-4263-a1be-dd033f078d49
exploitvdb-entrytechnical-descriptionThird Party Advisory

Link	Providers	Tags
https://wpscan.com/vulnerability/f5ea6c8a-6b07-4263-a1be-dd033f078d49		exploitvdb-entrytechnical-descriptionThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner WPScan

Published Sep 25, 2023

Updated Apr 23, 2025

Reserved Aug 9, 2023

Link CVE-2023-4281

CISA Vulnrichment

Updated Apr 23, 2025

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2023-4281

Red Hat

Severity n/a

Public date n/a

Links CVE-2023-4281