What’s Vulnerable › Vulnerabilities

CVE-2026-82530: IP2Location Country Blocker < 2.45.0 Access Control Bypass via X-Real-IP Header

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-09 · updated 2026-09-09
• Weakness: CWE-290

Description

IP2Location Country Blocker plugin for WordPress before 2.45.0 contains an access control bypass vulnerability that allows unauthenticated remote attackers to circumvent IP-based restrictions by forging the X-Real-IP HTTP header. Attackers can set the X-Real-IP header to an allowlisted IP address to bypass page, link, or site-wide access restrictions and access otherwise-blocked resources.

Affected products

• IP2Location Country Blocker: before 2.45.0 — fixed in 2.45.0

How to fix

Upgrade to a fixed version: IP2Location Country Blocker 2.45.0. Check the vendor advisory for mitigations.

References

• https://wordpress.org/plugins/ip2location-country-blocker/#developers
• https://www.vulncheck.com/advisories/ip2location-country-blocker-access-control-bypass-via-x-real-ip-header

Get alerted when CVE-2026-82530 or the next vulnerability affects your stack