CVE-2021-25095

IP2Location Country Blocker < 2.26.5 - Subscriber+ Arbitrary Country Ban

The IP2Location Country Blocker WordPress plugin before 2.26.5 does not have authorisation and CSRF checks in the ip2location_country_blocker_save_rules AJAX action, allowing any authenticated users, such as subscriber to call it and block arbitrary country, or block all of them at once, preventing users from accessing the frontend.

Affected

IP2Location Country Blocker

CVSS v3.1 NVD

7.1 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

CVSS v2.0 NVD

5.5 MEDIUMAV:N/AC:L/Au:S/C:N/I:P/A:P

EPSS

0.54% chance of exploitation in the next 30 days, 44th percentile

Published

2022-02-07

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/cbfa7211-ac1f-4cf2-bd79-ebce2fc4baa1

Security advisories

• https://plugins.trac.wordpress.org/changeset/2652469

References

• CVE Record
• NVD entry