PoC Index

CVE-2023-5133

HIGH 7.5EPSS 0.5%

This user-activity-log-pro WordPress plugin before 2.3.4 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to hide the source of malicious traffic.

CVSS v3.1
7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v3.1
7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS
0.55% chance of exploitation in the next 30 days, 44th percentile
Published
2023-10-16
Updated
2025-04-23

Proof-of-concept exploits (1)

References

Related