CVE-2021-25108: IP2Location Country Blocker < 2.26.6 - Arbitrary Country Ban via CSRF

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-02-07 · updated 2026-06-17
Weakness: CWE-352

Description

The IP2Location Country Blocker WordPress plugin before 2.26.6 does not have CSRF check in the ip2location_country_blocker_save_rules AJAX action, allowing attackers to make a logged in admin block arbitrary country, or block all of them at once, preventing users from accessing the frontend.

Affected products

IP2Location Country Blocker: before 2.26.6 — fixed in 2.26.6

How to fix

Upgrade to a fixed version: IP2Location Country Blocker 2.26.6. Check the vendor advisory for mitigations.

References

https://plugins.trac.wordpress.org/changeset/2653459
https://wpscan.com/vulnerability/9d416ca3-bd02-4fcf-b3b8-f2f2280d02d2
https://plugins.trac.wordpress.org/changeset/2653459
https://wpscan.com/vulnerability/9d416ca3-bd02-4fcf-b3b8-f2f2280d02d2

Get alerted when CVE-2021-25108 or the next vulnerability affects your stack