CVE-2024-0970: User Activity Tracking and Log < 4.1.4 - IP Spoofing
Published May 15, 2025
·Updated
This User Activity Tracking and Log WordPress plugin before 4.1.4 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value.
Affected Software
2 affected components
WordPress User Activity Tracking and Log<4.1.4
Mooveagency User Activity Tracking And Log Wordpress<4.1.4
Event History
May 15, 2025
CVE Published
via MITRE·08:09 PM
Data Sourced
via MITRE·08:09 PM
DescriptionWeakness
Data Sourced
via NVD·08:15 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-0970?
CVE-2024-0970 is considered a medium severity vulnerability due to its potential impact on user privacy.
2
How do I fix CVE-2024-0970?
To remediate CVE-2024-0970, upgrade the User Activity Tracking and Log plugin to version 4.1.4 or later.
3
What kind of attacks can CVE-2024-0970 enable?
CVE-2024-0970 can allow attackers to spoof client IP addresses, potentially leading to further attacks such as impersonation.
4
Which versions of WordPress are affected by CVE-2024-0970?
CVE-2024-0970 affects the User Activity Tracking and Log plugin versions prior to 4.1.4.
5
Is CVE-2024-0970 a persistent vulnerability?
CVE-2024-0970 requires the presence of the vulnerable plugin to be exploited, making it context-dependent.