CVE-2025-1361
Published: 22 February 2025
Description
The IP2Location Country Blocker plugin for WordPress is vulnerable to Regular Information Exposure in all versions up to, and including, 2.38.8 due to missing capability checks on the admin_init() function. This makes it possible for unauthenticated attackers to view the plugin's settings.
Security Summary
CVE-2025-1361 is a Regular Information Exposure vulnerability in the IP2Location Country Blocker plugin for WordPress, affecting all versions up to and including 2.38.8. The issue arises from missing capability checks in the admin_init() function, which allows unauthorized access to the plugin's settings. Published on 2025-02-22, it carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and maps to CWEs 285 (Improper Authorization) and 862 (Missing Authorization).
Unauthenticated attackers can exploit this vulnerability over the network with low attack complexity and no user interaction or privileges required. Exploitation enables remote viewing of the plugin's sensitive settings, resulting in high confidentiality impact but no disruption to integrity or availability.
Advisories recommend updating the plugin to a version that addresses the missing capability checks, with a patch available in WordPress plugin trac changeset 3244193. Additional details are provided in the Wordfence threat intelligence report and the plugin's developer page on WordPress.org, including source code review at the trac browser location for line 114 in ip2location-country-blocker.php.
Details
- CWE(s)