{
 "id": "WPSEC-2026-0974",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0974/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0974/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0974/index.md",
 "title": "Site Reviews <= 8.3.4 - Unauthenticated IP Address Spoofing via Proxy HTTP Header",
 "description": "The Site Reviews plugin for WordPress is vulnerable to IP Address Spoofing via the configured proxy HTTP header in versions 7.0.0 up to, and including, 8.3.4, due to the Trusted Proxies list being registered with the IP detection library under the header name instead of the custom-headers method key, so the selected proxy header was read from every request regardless of which address sent it, and the first (client-controlled) address in the header was used. This makes it possible for unauthenticated attackers to forge the IP address recorded with a submitted review, bypassing IP-based review limits, the blacklist and the IP checks used by the spam and captcha integrations. Exploitation requires that an administrator has selected a proxy HTTP header in the IP Address Detection tool.",
 "plugin": {
  "slug": "site-reviews",
  "name": "Site Reviews",
  "full_name": "Site Reviews",
  "wordpress_org": "https://wordpress.org/plugins/site-reviews/",
  "advisories_url": "https://wpsec.com/vuln/plugin/site-reviews/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/site-reviews"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-348"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": "7.0.0",
    "from_inclusive": true,
    "to": "8.3.5",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 7.0.0 before 8.3.5"
  ]
 },
 "introduced_in": "7.0.0",
 "fixed_in": "8.3.5",
 "remediation": "Update to 8.3.5 or later.",
 "fix_released": "2026-10-13T23:34:55+00:00",
 "published": "2026-10-14T23:40:51+00:00",
 "updated": "2026-10-14T14:17:50.018064+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0974/",
  "https://plugins.svn.wordpress.org/site-reviews/tags/8.3.5/",
  "https://wordpress.org/plugins/site-reviews/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/site-reviews",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-14"
 }
}