# All 404 Redirect to Homepage <= 5.7 - Unauthenticated IP Address Spoofing via Forwarded Headers

- **ID:** WPSEC-2026-1647
- **Plugin:** All 404 Redirect to Homepage (`all-404-redirect-to-homepage`), https://wordpress.org/plugins/all-404-redirect-to-homepage/
- **Affected versions:** all versions before 5.8
- **Fixed in:** 5.8 (Update to 5.8 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-348
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-25)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/all-404-redirect-to-homepage
- **Fix released:** 2026-10-24
- **Published:** 2026-10-25
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1647/

## Description

The All 404 Redirect to Homepage plugin for WordPress is vulnerable to IP Address Spoofing via the 404 log in all versions up to, and including, 5.7. This is due to the p404_get_visitor_ip() function reading the visitor IP from client-controlled headers such as CF-Connecting-IP, Client-IP, X-Forwarded-For and X-Real-IP before REMOTE_ADDR, without checking that the request came from a trusted proxy. This makes it possible for unauthenticated attackers to forge the IP address recorded in the 404 log and in the administrator statistics.

## References

- https://wpsec.com/vuln/WPSEC-2026-1647/
- https://plugins.svn.wordpress.org/all-404-redirect-to-homepage/tags/5.8/
- https://wordpress.org/plugins/all-404-redirect-to-homepage/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1647/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.