CVE-2024-0970

User Activity Tracking and Log < 4.1.4 - IP Spoofing

This User Activity Tracking and Log WordPress plugin before 4.1.4 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value.

Affected

User Activity Tracking and Log

CVSS v3.1 CNA

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS

0.38% chance of exploitation in the next 30 days, 30th percentile

Published

2025-05-15

Updated

2025-11-13

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/7df6877c-6640-41be-aacb-20c7da61e4db/

Security advisories

• https://wpscan.com/vulnerability/7df6877c-6640-41be-aacb-20c7da61e4db

References

• CVE Record
• NVD entry