Plugin Exposes IP Addresses of Requests via X-FORWARDED Header
CVE-2024-0868
Currently unrated
What is CVE-2024-0868?
The coreActivity: Activity Logging plugin for WordPress plugin before 2.1 retrieved IP addresses of requests via headers such X-FORWARDED to log them, allowing users to spoof them by providing an arbitrary value
Affected Version(s)
coreActivity: Activity Logging plugin for WordPress 0 < 2.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.