/Vulnerability Library

IP2Location Country Blocker < 2.38.9 - Unauthenticated Information Disclosure

CVE-2025-1361
Verified

Description

IP2Location Country Blocker plugin for WordPress up to version 2.38.8 contains a regular information exposure caused by missing capability checks on admin_init(), letting unauthenticated attackers view plugin settings, exploit requires no special conditions.

Severity

High

CVSS Score

7.5

Exploit Probability

1%

Published Date

April 22, 2026

Template Author

pussycat0x

CVE-2025-1361.yaml
7.5Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVE ID:
cve-2025-1361
CWE ID:
cwe-862

References

https://www.wordfence.com/threat-intel/vulnerabilities/id/b63bc2b6-1abc-4cfa-a7e5-3995640f66a7https://wpscan.com/vulnerability/3629be51-7c7e-4677-917f-a0693df3980f/https://wordpress.org/plugins/ip2location-country-blocker/

Remediation Steps

Update to the latest version of the plugin that fixes the capability check issue.