PT-2022-9650 · WordPress · Ip2Location Country Blocker

Krzysztof Zając · Published 2022-02-07 · Updated 2022-12-09 · CVE-2021-25095

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions IP2Location Country Blocker WordPress plugin versions prior to 2.26.5

Description The issue concerns a lack of authorization and CSRF checks in the ip2location country blocker save rules AJAX action. This allows any authenticated users, such as subscribers, to call the action and block arbitrary countries or all of them at once, preventing users from accessing the frontend.

Recommendations For versions prior to 2.26.5, update to version 2.26.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the ip2location country blocker save rules AJAX action to prevent unauthorized changes.

Exploit

Fix

Missing Authorization

CSRF

Weakness Enumeration

CWE-862

CWE-352

Related Identifiers

CVE-2021-25095

Affected Products

Ip2Location Country Blocker

References · 6

• 🔥 https://wpscan.com/vulnerability/cbfa7211-ac1f-4cf2-bd79-ebce2fc4baa1 · Exploit
• https://plugins.trac.wordpress.org/changeset/2652469 · Patch
• https://osv.dev/vulnerability/CVE-2021-25095 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-25095 · Security Note
• https://t.me/cvenotify/37168 · Telegram Post
• https://t.me/cibsecurity/36957 · Telegram Post