PT-2026-6896 · WordPress · Advanced Country Blocker

Hector Flores · Published 2026-02-07 · Updated 2026-02-07 · CVE-2026-1675

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Advanced Country Blocker plugin for WordPress versions prior to 2.3.2

Description The Advanced Country Blocker plugin for WordPress is susceptible to an authorization bypass. This is due to the use of a predictable default value for the secret bypass key during installation, which is not required to be changed by users. An unauthenticated attacker can bypass the geolocation blocking mechanism by appending this key to any URL on sites where the administrator has not modified the default value.

Recommendations Update the Advanced Country Blocker plugin to version 2.3.2 or later. Change the default secret bypass key to a strong, unique value.

Fix

Weakness Enumeration

CWE-1188

Related Identifiers

CVE-2026-1675

Affected Products

Advanced Country Blocker

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-1675 · Security Note
• https://plugins.trac.wordpress.org/browser/advanced-country-blocker/tags/2.3.1/advanced-country-blocking.php#L278 · Note
• https://plugins.trac.wordpress.org/changeset/3455225 · Note
• https://twitter.com/CVEnew/status/2020061005397569569 · Twitter Post
• https://plugins.trac.wordpress.org/browser/advanced-country-blocker/tags/2.3.1/advanced-country-blocking.php#L336 · Note
• https://plugins.trac.wordpress.org/browser/advanced-country-blocker/tags/2.3.1/advanced-country-blocking.php#L420 · Note
• https://t.me/CVEtracker/44022 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/30747988-83f9-41f9-9bc5-1f533bc4cb94?source=cve · Note