CVE-2024-3050: 
WordPress vulnerability analysis and mitigation

The Site Reviews WordPress plugin before version 7.0.0 contains a vulnerability that allows attackers to manipulate client IP addresses through potentially untrusted headers. This vulnerability was discovered and disclosed on May 29, 2024, and was assigned identifier CVE-2024-3050. The vulnerability affects all versions of the Site Reviews plugin prior to version 7.0.0 (WPScan, NVD).

The vulnerability stems from improper validation of client IP addresses obtained from HTTP headers. The plugin retrieves IP addresses from potentially untrusted headers, which can be manipulated by attackers. This vulnerability has been classified as a spoofing issue (CWE-290) and has received a CVSS v3.1 base score of 9.1 (Critical) from CISA-ADP, with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (WPScan).

The vulnerability can be exploited to bypass IP-based blocking mechanisms implemented by the plugin. This could potentially allow attackers to circumvent security measures that rely on IP address verification, such as rate limiting or access controls (NVD).

A proof of concept exists demonstrating how an attacker can manipulate IP addresses by including specific headers in their HTTP requests, such as X-Forwarded-For and cf-connecting-ip. The vulnerability can be exploited remotely without requiring authentication (WPScan).

The vulnerability has been fixed in version 7.0.0 of the Site Reviews plugin. Users are advised to update to this version or later to mitigate the risk (WPScan).