PT-2026-1604 · WordPress · Aa Block Country

Ivan Cese · CVE-2025-13694 · Published 2026-01-07 · Updated 2026-01-07

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions AA Block Country plugin for WordPress versions up to and including 1.0.1

Description The AA Block Country plugin for WordPress is susceptible to IP Address Spoofing. The plugin relies on user-provided headers, specifically the HTTP X FORWARDED FOR header, to identify the client’s IP address without sufficient validation. This lack of validation is particularly problematic when the server is located behind a trusted proxy. An unauthenticated attacker can exploit this flaw to circumvent IP-based access controls by manipulating the X-Forwarded-For header and spoofing their IP address.

Recommendations Update the AA Block Country plugin to a version beyond 1.0.1.

Fix

Weakness Enumeration

CWE-348

Related Identifiers

CVE-2025-13694

Affected Products

Aa Block Country

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-13694 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/037ac32a-dc2e-4e9f-9318-65dfee1c80e9?source=cve · Note
• https://plugins.trac.wordpress.org/browser/aa-block-country/tags/1.0.1/aablockcountry.php#L26 · Note
• https://twitter.com/CVEnew/status/2008838605108646286 · Twitter Post
• https://plugins.trac.wordpress.org/browser/aa-block-country/trunk/aablockcountry.php#L26 · Note