WordPress Plugin Vulnerabilities

User Activity <= 1.0.1 - IP Spoofing

Description

The plugin checks headers such as the X-Forwarded-For to retrieve the IP address of the request, which could lead to IP spoofing

Proof of Concept

Affects Plugins

Plugin icon
user-activity
No known fix

References

CVE
CVE-2022-4550

Miscellaneous

Original Researcher
rezaduty
Submitter
rezaduty
Verified
Yes
WPVDB ID
a1179959-2044-479f-a5ca-3c9ffc46d00e

Timeline

Publicly Published
2023-02-03 (about 2 years ago)
Added
2023-02-03 (about 2 years ago)
Last Updated
2023-02-03 (about 2 years ago)

Other

Published
Title
Published
2014-08-01
Title
Wordpress <= 2.8.3 - Remote Admin Password Reset
Published
2014-08-01
Title
WordPress 2.9 - Failure to Restrict URL Access
Published
2014-08-01
Title
Method 2.1 - dl-skin.php _mysite_delete_skin_zip Parameter Absolute Path Traversal Remote Directory Deletion
Published
2014-08-01
Title
Myriad 2.0 - dl-skin.php _mysite_delete_skin_zip Parameter Absolute Path Traversal Remote Directory Deletion
Published
2024-03-26
Title
WP Reset < 2.0 - Sensitive Information Exposure due to Insufficient Randomness