Vulnerabilities / All 404 Redirect to Homepage / WPSEC-2026-1647
All 404 Redirect to Homepage <= 5.7 - Unauthenticated IP Address Spoofing via Forwarded Headers
Medium 5.3
CWE-348Fixed in 5.8
- ID
- WPSEC-2026-1647
- Plugin
- All 404 Redirect to Homepage (all-404-redirect-to-homepage)
- Affected
- all versions before 5.8
- Remediation
- Update to 5.8 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-348
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-25
- Attack surface
- All 404 Redirect to Homepage on WPSec AttackSurface
- Fix released
- Published
Description
The All 404 Redirect to Homepage plugin for WordPress is vulnerable to IP Address Spoofing via the 404 log in all versions up to, and including, 5.7. This is due to the p404_get_visitor_ip() function reading the visitor IP from client-controlled headers such as CF-Connecting-IP, Client-IP, X-Forwarded-For and X-Real-IP before REMOTE_ADDR, without checking that the request came from a trusted proxy. This makes it possible for unauthenticated attackers to forge the IP address recorded in the 404 log and in the administrator statistics.
References
- https://wpsec.com/vuln/WPSEC-2026-1647/
- https://plugins.svn.wordpress.org/all-404-redirect-to-homepage/tags/5.8/
- https://wordpress.org/plugins/all-404-redirect-to-homepage/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS