CVE-2023-5239: cleantalk security_\&_malware_scan Use of Less Trusted Source

Vulnerability summary

CVE-2023-5239 is a high (CVSS 7.5) Use of Less Trusted Source vulnerability in cleantalk security_\&_malware_scan. EPSS estimates a 0.65% chance of exploitation in the next 30 days, higher than 50.6% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 27-11-2023
   PublishedVulnerability first disclosed.
2. 02-08-2024
   Last modifiedVulnerability information updated.

Description

The Security & Malware scan by CleanTalk WordPress plugin before 2.121 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to bypass bruteforce protection.

• CWE-348Use of Less Trusted SourceThe product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.