Site Reviews <= 8.3.4 - Unauthenticated IP Address Spoofing via Proxy HTTP Header
- ID
- WPSEC-2026-0974
- Plugin
- Site Reviews (site-reviews)
- Affected
- from 7.0.0 before 8.3.5
- Remediation
- Update to 8.3.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-348
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-14
- Attack surface
- Site Reviews on WPSec AttackSurface
- Fix released
- Published
Description
The Site Reviews plugin for WordPress is vulnerable to IP Address Spoofing via the configured proxy HTTP header in versions 7.0.0 up to, and including, 8.3.4, due to the Trusted Proxies list being registered with the IP detection library under the header name instead of the custom-headers method key, so the selected proxy header was read from every request regardless of which address sent it, and the first (client-controlled) address in the header was used. This makes it possible for unauthenticated attackers to forge the IP address recorded with a submitted review, bypassing IP-based review limits, the blacklist and the IP checks used by the spam and captcha integrations. Exploitation requires that an administrator has selected a proxy HTTP header in the IP Address Detection tool.
References
- https://wpsec.com/vuln/WPSEC-2026-0974/
- https://plugins.svn.wordpress.org/site-reviews/tags/8.3.5/
- https://wordpress.org/plugins/site-reviews/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS