Executive brief
IP2Location Country Blocker is a WordPress plugin that restricts website access based on visitor IP geolocation, blocking traffic from specified countries or IP ranges to protect sites from unwanted visitors. An unauthenticated attacker can forge the X-Real-IP HTTP header to spoof their IP address as an allowlisted one, completely bypassing IP-based restrictions and gaining access to blocked pages, admin areas, or entire websites.
Technical details
The vulnerability is an authentication bypass (CWE-290) caused by improper IP address validation in the plugin's access control logic. The plugin trusts the X-Real-IP HTTP header to determine a visitor's source IP without proper validation or fallback to the actual connection source, allowing attackers to set this header to any value. An unauthenticated network attacker can craft an HTTP request with X-Real-IP set to an allowlisted IP address to bypass all country-based and IP-based blocking rules. This affects both frontend page blocking and backend WordPress admin area restrictions. The vulnerability was patched in version 2.45.0 according to the plugin changelog.
Affected products
- IP2Location Country Blocker before 2.45.0
Timeline
- 2026-09-09: disclosed
- 2026-09-09: patched: Version 2.45.0 released