by Kastro
Paper/Archive/CVE-2024-3050

CVE-2024-3050

Unknown Site Reviews — Site Reviews < 7.0.0 - IP Spoofing

EPSS 0.6%public exploitCVSS 9.1
critical.is priorityof 100
47
CVSS 9.1 (ADP)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 46.9.469 × 209.4Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

The Site Reviews WordPress plugin before 7.0.0 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to bypass IP-based blocking

Affected

ProductAffectedFixed inSource
Site Reviews< 7.0.07.0.0CNA
site_reviews< 7.0.07.0.0CISA-ADP

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitwpscan.com/vulnerability/04c1581e-fd36-49d4-8463-b49915d4b1ac