CVE-2024-0970: 
WordPress vulnerability analysis and mitigation

The User Activity Tracking and Log WordPress plugin before version 4.1.4 contains a vulnerability identified as CVE-2024-0970, discovered and disclosed on January 26, 2024. The vulnerability affects the IP address logging functionality of the plugin, impacting all versions prior to 4.1.4 (WPScan).

The vulnerability stems from the plugin's improper handling of client IP addresses, where it retrieves IP information from potentially untrusted headers. This implementation flaw allows attackers to manipulate the IP address value that gets logged by the system. The vulnerability has been assigned a CVSS score of 5.3 (medium) and is classified as a spoofing vulnerability under CWE-290 (Authentication Bypass by Spoofing) (WPScan).

When exploited, this vulnerability allows attackers to manipulate the IP address values stored in the activity log. This can lead to incorrect IP address logging, potentially masking the true source of user activities and compromising the integrity of the logging system (WPScan).

The vulnerability has been patched in version 4.1.4 of the User Activity Tracking and Log plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).