CVE-2021-25108 IP2Location Country Blocker < 2.26.6 - Arbitrary Country Ban via CSRF

2022-02-0715:47:24

CWE-352

WPScan

www.cve.org

0.001 Low

EPSS

Percentile

37.9%

JSON

The IP2Location Country Blocker WordPress plugin before 2.26.6 does not have CSRF check in the ip2location_country_blocker_save_rules AJAX action, allowing attackers to make a logged in admin block arbitrary country, or block all of them at once, preventing users from accessing the frontend.

CNA Affected

[
  {
    "product": "IP2Location Country Blocker",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "2.26.6",
        "status": "affected",
        "version": "2.26.6",
        "versionType": "custom"
      }
    ]
  }
]