CVE-2023-4281: activity_log_project activity_log Use of Less Trusted Source

Vulnerability summary

CVE-2023-4281 is a medium (CVSS 5.3) Use of Less Trusted Source vulnerability in activity_log_project activity_log. EPSS estimates a 0.72% chance of exploitation in the next 30 days, higher than 53% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 25-09-2023
   PublishedVulnerability first disclosed.
2. 23-04-2025
   Last modifiedVulnerability information updated.

Description

This Activity Log WordPress plugin before 2.8.8 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to hide the source of malicious traffic.

• CWE-348Use of Less Trusted SourceThe product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.