PT-2026-6896 · WordPress · Advanced Country Blocker

Hector Flores · Publicado 2026-02-07 · Atualizado 2026-02-07 · CVE-2026-1675

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Advanced Country Blocker plugin for WordPress versions prior to 2.3.2

Description The Advanced Country Blocker plugin for WordPress is susceptible to an authorization bypass. This is due to the use of a predictable default value for the secret bypass key during installation, which is not required to be changed by users. An unauthenticated attacker can bypass the geolocation blocking mechanism by appending this key to any URL on sites where the administrator has not modified the default value.

Recommendations Update the Advanced Country Blocker plugin to version 2.3.2 or later. Change the default secret bypass key to a strong, unique value.

Correção

Enumeração de Fraquezas

CWE-1188

Identificadores relacionados

CVE-2026-1675

Produtos afetados

Advanced Country Blocker

Referências · 8

• https://plugins.trac.wordpress.org/browser/advanced-country-blocker/tags/2.3.1/advanced-country-blocking.php#L278 · Nota
• https://plugins.trac.wordpress.org/changeset/3455225 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-1675 · Nota de Segurança
• https://twitter.com/CVEnew/status/2020061005397569569 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/advanced-country-blocker/tags/2.3.1/advanced-country-blocking.php#L336 · Nota
• https://plugins.trac.wordpress.org/browser/advanced-country-blocker/tags/2.3.1/advanced-country-blocking.php#L420 · Nota
• https://t.me/CVEtracker/44022 · Publicação no Telegram
• https://wordfence.com/threat-intel/vulnerabilities/id/30747988-83f9-41f9-9bc5-1f533bc4cb94?source=cve · Nota