CVE-2024-21746: WP Ultimate Review Auth Bypass Vulnerability

CVE-2024-21746 Overview

CVE-2024-21746 is an Authentication Bypass by Spoofing vulnerability [CWE-290] affecting the Roxnor WP Ultimate Review plugin for WordPress. The flaw exists in all versions up to and including 2.3.6 and allows attackers to spoof their identity to bypass the plugin's IP-based submission limits. Because the plugin trusts client-controlled headers when identifying reviewers, remote attackers can submit multiple reviews while masquerading as different users. The issue is exploitable over the network without authentication or user interaction.

Critical Impact

Unauthenticated attackers can spoof their identity to bypass the IP limit control in WP Ultimate Review, enabling review fraud and integrity loss on affected WordPress sites.

Affected Products

• Roxnor / Wpmet WP Ultimate Review plugin for WordPress
• All versions from n/a through 2.3.6
• WordPress sites with the wp-ultimate-review plugin installed and active

Discovery Timeline

• 2024-05-17 - CVE-2024-21746 published to NVD
• 2026-04-29 - Last updated in NVD database

Technical Details for CVE-2024-21746

Vulnerability Analysis

The vulnerability is classified under CWE-290: Authentication Bypass by Spoofing. WP Ultimate Review enforces a per-IP submission limit to prevent users from posting more than one review per product or page. The plugin determines the submitter's IP from request data that can be influenced by the client, so the control can be bypassed by spoofing the source identifier. The result is a high-impact integrity issue — attackers can flood a site with fraudulent reviews while confidentiality and availability are not directly affected.

This class of bug is common in WordPress plugins that rely on headers such as X-Forwarded-For or Client-IP without validating that the request actually traversed a trusted proxy. According to the Patchstack Vulnerability Report, the IP limit can be bypassed in versions up to 2.2.5 and remained exploitable through 2.3.6.

Root Cause

The plugin identifies a reviewer using a client-controlled value rather than a server-derived identifier. When the review submission handler reads the IP address from a request header, an attacker can supply an arbitrary value on each request. The deduplication check then compares against spoofed identities and never triggers, allowing the same actor to submit unlimited reviews.

Attack Vector

An unauthenticated remote attacker sends crafted HTTP POST requests to the plugin's public review submission endpoint. On each request, the attacker rotates the spoofed client IP header value. The plugin records each submission as originating from a distinct user, bypassing the rate and uniqueness controls. No credentials, tokens, or user interaction are required.

No verified public exploit code is available for this CVE. Refer to the Patchstack WP Ultimate Review Vulnerability advisory for additional technical context.

Detection Methods for CVE-2024-21746

Indicators of Compromise

• Multiple review submissions to wp-admin/admin-ajax.php or plugin-specific endpoints originating from the same TCP source but carrying different X-Forwarded-For or Client-IP header values.
• Spikes in review counts on pages using the wp-ultimate-review shortcode without a corresponding increase in unique site visitors.
• Review records in the WordPress database with sequential timestamps and varied stored IP values that do not match web server access logs.

Detection Strategies

• Correlate plugin-stored reviewer IPs against the upstream web server or reverse proxy access log to identify mismatches that indicate header spoofing.
• Hunt for HTTP requests to WP Ultimate Review endpoints where client-supplied IP headers vary rapidly from a single TCP peer.
• Inventory WordPress sites for the wp-ultimate-review plugin at versions <= 2.3.6 using software composition or asset management tooling.

Monitoring Recommendations

• Enable verbose logging on the WordPress reverse proxy or WAF to capture the original client IP alongside any forwarded headers.
• Alert on bursts of POST requests to review submission endpoints exceeding normal baselines for the site.
• Periodically review the WordPress wp_options and plugin tables for anomalous review volume or duplicate content patterns.

How to Mitigate CVE-2024-21746

Immediate Actions Required

• Update the WP Ultimate Review plugin to a version later than 2.3.6 as soon as the vendor publishes a fixed release.
• If no patched version is available, deactivate and remove the wp-ultimate-review plugin from production WordPress sites.
• Restrict access to review submission endpoints behind a WAF rule that strips or validates client-supplied IP headers.

Patch Information

No vendor-published fixed version is referenced in the NVD record. The advisory states the issue affects WP Ultimate Review from n/a through <= 2.3.6. Site administrators should monitor the Patchstack Vulnerability Report and the WordPress plugin repository for an updated release and apply it through the WordPress admin dashboard or wp-cli.

Workarounds

• Configure the upstream proxy or load balancer to overwrite incoming X-Forwarded-For and Client-IP headers with the verified peer address before passing requests to WordPress.
• Deploy a WAF rule to block or normalize requests containing attacker-controlled IP headers destined for review submission URLs.
• Add a CAPTCHA or authenticated-user requirement to review submission forms to reduce abuse until a vendor patch is available.

# Example nginx configuration to overwrite client IP headers
# Drop any client-supplied X-Forwarded-For and set it from the real peer
location / {
    proxy_set_header X-Forwarded-For $remote_addr;
    proxy_set_header X-Real-IP       $remote_addr;
    proxy_pass http://wordpress_upstream;
}