Executive brief
The IP2Location Country Blocker plugin for WordPress, which is used to restrict website access based on geographic location, contains a security flaw. An authorized user can inject malicious scripts into the plugin's settings. These scripts will run automatically when an administrator views the settings page, potentially allowing the attacker to hijack administrative sessions or modify site content.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the IP2Location Country Blocker plugin (version 2.26.7 and earlier) due to insufficient sanitization of user-supplied data. An authenticated attacker with access to the plugin's 'Frontend Settings' can inject arbitrary JavaScript or HTML into the 'URL' input field within the 'Other Settings' area. This payload is stored in the database and executed in the context of any user (including administrators) who subsequently visits the plugin settings page. This can lead to session hijacking, unauthorized administrative actions, or further site compromise. A proof-of-concept exploit has been publicly disclosed.
Affected products
- IP2Location IP2Location Country Blocker <= 2.26.7
Timeline
- 2022-02-02: disclosed: Vulnerability discovered and exploit developed by Ahmet Serkan Ari.
- 2022-02-04: other: Exploit published on Exploit-DB.
- 2026-05-10: advisory: NVD and VulnCheck published advisory details.