CVE-2026-82530

MediumCVSS 5.3

Published: 09/09/2026(UTC)Updated: 09/09/2026(UTC)Translated: 09/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

18th percentile - higher than 18% of all known CVEs

Summary

IP2Location Country Blocker plugin for WordPress before 2.45.0 contains an access control bypass vulnerability that allows unauthenticated remote attackers to circumvent IP-based restrictions by forging the X-Real-IP HTTP header. Attackers can set the X-Real-IP header to an allowlisted IP address to bypass page, link, or site-wide access restrictions and access otherwise-blocked resources.

Risk Assessment

Risk of unauthorized access to protected content or site functionality, potentially compromising data confidentiality or integrity.

Recommendation

Update the IP2Location Country Blocker plugin to version 2.45.0 or later to remediate the vulnerability.

Other vulnerabilities in IP2Location Country Blocker

CVE-2022-50961Medium
WordPress Plugin IP2Location Country Blocker 2.26.7 contains a stored cross-site scripting vulnerability that allows authenticated users to inject arbitrary JavaScript code through the Frontend Settings interface. Attackers can inject malicious scripts in the URL field of the Display page settings that execute when administrators visit the plugin settings page.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS