CVE-2025-1361

HIGH7.5

IP2Location Country Blocker <= 2.38.8 - Missing Authorization to Unauthenticated Information Exposure via admin_init Function

Published Feb 22, 2025

Modified 2 weeks ago

Details

The IP2Location Country Blocker plugin for WordPress is vulnerable to Regular Information Exposure in all versions up to, and including, 2.38.8 due to missing capability checks on the admin_init() function. This makes it possible for unauthenticated attackers to view the plugin's settings.

References

WEB

https://plugins.trac.wordpress.org/browser/ip2location-country-blocker/trunk/ip2location-country-blocker.php#L114

WEB

https://plugins.trac.wordpress.org/changeset/3244193/

WEB

https://wordpress.org/plugins/ip2location-country-blocker/#developers

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2025-1361

WEB

https://www.wordfence.com/threat-intel/vulnerabilities/id/b63bc2b6-1abc-4cfa-a7e5-3995640f66a7?source=cve

CVSS Analysis