CVE-2023-5239 json
Security & Malware scan by CleanTalk < 2.121 - IP Spoofing
published 2023-11-27 2 y ago modified 2026-06-17 4 mo ago also EUVD-2023-57566
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 51%
- public exploits
- 0
- none known
Summary
The Security & Malware scan by CleanTalk WordPress plugin before 2.121 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to bypass bruteforce protection.
Patch / fix
- Unknown Security & Malware scan by CleanTalk 2.121
Exploit prediction
0.65% chance of exploitation in the next 30 days, higher than 51% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- wpscan.com https://wpscan.com/vulnerability/1d748f91-773b-49d6-8f68-a27d397713c3 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Affected products
- Unknown Security & Malware scan by CleanTalk
Classification
- Technology feeds
References
-
wpscan.com
/vulnerability/1d748f91-773b-49d6-8f68-a27d397713c3
exploit, vdb-entry, technical-description, third-party-advisory
Sources
- CVE List CVE-2023-5239
- NVD CVE-2023-5239
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.