CVE-2024-3050 Site Reviews < 7.0.0 - IP Spoofing
Attackers can spoof IP addresses via untrusted headers to bypass IP-based blocking mechanisms in the Site Reviews WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-3050?
CVE-2024-3050 is a critical vulnerability in Unknown Site Reviews, published on 29 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Site Reviews WordPress plugin before 7.0.0 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to bypass IP-based blocking
Which versions are affected by CVE-2024-3050?
It affects 1 product.
Products include Geminilabs Site Reviews.
How do I fix CVE-2024-3050?
No fix has been published for CVE-2024-3050 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-3050 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-3050 exists.
Other vulnerabilities in Unknown Site Reviews
- CVE-2025-1232 Site Reviews < 7.2.5 - Unauthenticated Stored XSS
- CVE-2023-27612 WordPress Site Reviews Plugin <= 6.5.1 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-27629 WordPress Site Reviews Plugin <= 6.5.1 is vulnerable to Cross Site Scripting (XSS)
- CVE-2022-46801 WordPress Site Reviews Plugin <= 6.2.0 is vulnerable to CSV Injection
- CVE-2021-24973 Site Reviews < 5.17.3 - Unauthenticated Stored Cross-Site Scripting