Description

IP2Location Country Blocker plugin for WordPress before 2.45.0 contains an access control bypass vulnerability that allows unauthenticated remote attackers to circumvent IP-based restrictions by forging the X-Real-IP HTTP header. Attackers can set the X-Real-IP header to an allowlisted IP address to bypass page, link, or site-wide access restrictions and access otherwise-blocked resources.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-09T15:17:11.967Z",
  "pubdate": "2026-09-09T15:17:11.967Z",
  "executiveSummary": "The IP2Location Country Blocker plugin for WordPress, in versions prior to 2.45.0, is susceptible to an access control bypass vulnerability. This security flaw stems from the improper validation of incoming HTTP request headers used for source IP address identification.\nThe vulnerability allows unauthenticated remote attackers to circumvent established IP-based access restrictions. By manually injecting the 'X-Real-IP' HTTP header, an attacker can spoof a legitimate or allowlisted IP address, effectively tricking the plugin into granting unauthorized access to restricted site resources, pages, or links.\nThis represents a significant security risk, as the plugin's primary security function—geofencing or IP-based blocking—can be neutralized entirely by a remote actor without requiring administrative privileges or local system access. The attack is trivial to execute, requiring only a standard HTTP request modification.\nThe impact includes the unauthorized exposure of sensitive or protected content, potential circumvention of site-wide security policies, and the ability for restricted users or malicious actors from blocked regions to interact with WordPress resources. Organizations relying on this plugin for geographical compliance or security hardening are advised to update immediately.",
  "technicalDetails": "The root cause of this vulnerability lies in the plugin's insecure implementation of IP address retrieval logic. Specifically, the plugin relies on the 'X-Real-IP' HTTP header to determine the client's origin IP address. This header is commonly used in reverse proxy configurations (like Nginx or Cloudflare) to pass the actual client IP to the backend server. However, the plugin fails to sanitize this input or verify if the request originated from a trusted internal proxy.\nBecause the 'X-Real-IP' header is user-controllable, an attacker can inject an arbitrary IP address during the HTTP request lifecycle. When the IP2Location Country Blocker plugin processes the request, it checks the provided header value against its internal blacklist or whitelist configuration. By setting the 'X-Real-IP' value to an address explicitly permitted by the site administrator, the plugin's logic evaluates the request as authorized, ignoring the actual source IP of the request.\nThe attack flow is straightforward: 1) The attacker identifies a target site protected by IP2Location Country Blocker. 2) The attacker crafts an HTTP request using tools like cURL, Burp Suite, or standard browser extensions to modify headers. 3) The attacker sets the 'X-Real-IP' header to an IP address that is known to be in the plugin's allowlist (or an IP that satisfies the geographic requirements configured in the plugin). 4) The server processes the request, trusting the spoofed header over the actual TCP connection source IP. 5) The plugin grants access to the restricted resource, bypassing the intended security controls.\nThis vulnerability is classified as an access control bypass. It does not require any form of authentication or special privileges, as the plugin performs these checks during the early stages of the request lifecycle, typically before the WordPress core authentication processes. The network exposure is broad, as any internet-facing instance of the plugin is susceptible to this remote exploitation. There is no complex payload required; the malicious behavior is achieved through simple HTTP header manipulation. The post-exploitation impact allows for the unauthorized traversal of gated sections of the website, which may lead to further information disclosure or the exploitation of other vulnerabilities that were previously hidden behind IP-based access controls."
}