User Activity Log Pro < 2.3.4 - IP Spoofing

CVE-2023-5133

Summary

The User Activity Log Pro plugin for WordPress prior to version 2.3.4 is susceptible to a security flaw due to its handling of client IP addresses. It retrieves these addresses from potentially untrusted headers, which can be exploited by attackers to falsify the source of incoming traffic. This manipulation can assist malicious actors in disguising their activities, potentially compromising the integrity and security of WordPress sites using this plugin.

References