PT-2025-7500 · WordPress · Ip2Location Country Blocker

Abrahack · Published 2025-02-22 · Updated 2026-04-23 · CVE-2025-1361

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions IP2Location Country Blocker versions up to, and including, 2.38.8

Description The IP2Location Country Blocker plugin for WordPress is vulnerable to Regular Information Exposure due to missing capability checks on the admin init() function. This allows unauthenticated attackers to view the plugin's settings.

Recommendations For versions up to, and including, 2.38.8, update to a version that includes the necessary capability checks for the admin init() function to prevent unauthenticated access to the plugin's settings. As a temporary workaround, consider restricting access to the admin init() function until a patch is available.

Fix

Improper Authorization

Missing Authorization

Weakness Enumeration

CWE-285

CWE-862

Related Identifiers

CVE-2025-1361

Affected Products

Ip2Location Country Blocker

References · 12

• https://plugins.trac.wordpress.org/changeset/3244193 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-1361 · Security Note
• https://osv.dev/vulnerability/CVE-2025-1361 · Vendor Advisory
• https://plugins.trac.wordpress.org/browser/ip2location-country-blocker/trunk/ip2location-country-blocker.php#L114 · Note
• https://twitter.com/CVEnew/status/1893221824843899378 · Twitter Post
• https://wordpress.org/plugins/ip2location-country-blocker/#developers · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/b63bc2b6-1abc-4cfa-a7e5-3995640f66a7?source=cve · Note
• https://t.me/cvenotify/112135 · Telegram Post
• https://twitter.com/cybercronai/status/1893473493347344494 · Twitter Post
• https://t.me/latest_high_impact_cve/1867 · Telegram Post
• https://twitter.com/pdnuclei_bot/status/2047118283456000311 · Twitter Post
• https://t.me/cvedetector/18713 · Telegram Post