# Site Reviews <= 8.3.4 - Unauthenticated IP Address Spoofing via Proxy HTTP Header

- **ID:** WPSEC-2026-0974
- **Plugin:** Site Reviews (`site-reviews`), https://wordpress.org/plugins/site-reviews/
- **Affected versions:** from 7.0.0 before 8.3.5
- **Fixed in:** 8.3.5 (Update to 8.3.5 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-348
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/site-reviews
- **Fix released:** 2026-10-13
- **Published:** 2026-10-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0974/

## Description

The Site Reviews plugin for WordPress is vulnerable to IP Address Spoofing via the configured proxy HTTP header in versions 7.0.0 up to, and including, 8.3.4, due to the Trusted Proxies list being registered with the IP detection library under the header name instead of the custom-headers method key, so the selected proxy header was read from every request regardless of which address sent it, and the first (client-controlled) address in the header was used. This makes it possible for unauthenticated attackers to forge the IP address recorded with a submitted review, bypassing IP-based review limits, the blacklist and the IP checks used by the spam and captcha integrations. Exploitation requires that an administrator has selected a proxy HTTP header in the IP Address Detection tool.

## References

- https://wpsec.com/vuln/WPSEC-2026-0974/
- https://plugins.svn.wordpress.org/site-reviews/tags/8.3.5/
- https://wordpress.org/plugins/site-reviews/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0974/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.