PT-2022-9663 · WordPress · Ip2Location Country Blocker

Krzysztof Zając · Published 2022-02-07 · Updated 2022-02-25 · CVE-2021-25108

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions IP2Location Country Blocker WordPress plugin versions prior to 2.26.6

Description The issue concerns a lack of CSRF check in the ip2location country blocker save rules AJAX action. This allows attackers to make a logged-in admin block arbitrary countries or all of them at once, preventing users from accessing the frontend.

Recommendations For versions prior to 2.26.6, update to version 2.26.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the ip2location country blocker save rules AJAX action to minimize the risk of exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2021-25108

Affected Products

Ip2Location Country Blocker

References · 5

• 🔥 https://wpscan.com/vulnerability/9d416ca3-bd02-4fcf-b3b8-f2f2280d02d2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-25108 · Security Note
• https://plugins.trac.wordpress.org/changeset/2653459 · Patch
• https://osv.dev/vulnerability/CVE-2021-25108 · Vendor Advisory
• https://t.me/cibsecurity/36955 · Telegram Post