CVE-2023-51667: 
WordPress vulnerability analysis and mitigation

The Rate my Post – WP Rating System WordPress plugin contains an Authentication Bypass by Spoofing vulnerability, identified as CVE-2023-51667. The vulnerability affects versions up to and including 3.4.2 of the plugin. This security issue was discovered by Brandon James Roldan (tomorrowisnew) and was publicly disclosed on December 27, 2023 (WPScan).

The vulnerability stems from insufficient IP address validation and the use of user-supplied HTTP headers as a primary method for IP retrieval. This security flaw has been classified as CWE-290 (Authentication Bypass by Spoofing) and received a CVSS v3.1 score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (Patchstack).

The vulnerability allows unauthenticated attackers to vote on posts multiple times by spoofing their IP address. This broken access control issue could potentially manipulate the rating system's integrity (WPScan).

The vulnerability is classified as having low complexity (AC:L) and requires no privileges (PR:N) or user interaction (UI:N) to exploit. It can be accessed remotely through the network (AV:N) (Patchstack).

The vulnerability has been patched in version 3.4.3 of the Rate my Post – WP Rating System plugin. Users are advised to update to version 3.4.3 or later to remove the vulnerability. Patchstack users can enable auto-update for vulnerable plugins (Patchstack).