{
 "id": "WPSEC-2026-1647",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1647/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1647/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1647/index.md",
 "title": "All 404 Redirect to Homepage <= 5.7 - Unauthenticated IP Address Spoofing via Forwarded Headers",
 "description": "The All 404 Redirect to Homepage plugin for WordPress is vulnerable to IP Address Spoofing via the 404 log in all versions up to, and including, 5.7. This is due to the p404_get_visitor_ip() function reading the visitor IP from client-controlled headers such as CF-Connecting-IP, Client-IP, X-Forwarded-For and X-Real-IP before REMOTE_ADDR, without checking that the request came from a trusted proxy. This makes it possible for unauthenticated attackers to forge the IP address recorded in the 404 log and in the administrator statistics.",
 "plugin": {
  "slug": "all-404-redirect-to-homepage",
  "name": "All 404 Redirect to Homepage",
  "full_name": "All 404 Redirect to Homepage",
  "wordpress_org": "https://wordpress.org/plugins/all-404-redirect-to-homepage/",
  "advisories_url": "https://wpsec.com/vuln/plugin/all-404-redirect-to-homepage/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/all-404-redirect-to-homepage"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-348"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.8",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.8"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.8",
 "remediation": "Update to 5.8 or later.",
 "fix_released": "2026-10-24T18:59:02+00:00",
 "published": "2026-10-25T19:41:02+00:00",
 "updated": "2026-10-25T10:58:11.487875+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1647/",
  "https://plugins.svn.wordpress.org/all-404-redirect-to-homepage/tags/5.8/",
  "https://wordpress.org/plugins/all-404-redirect-to-homepage/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/all-404-redirect-to-homepage",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-25"
 }
}