VULNERABILITY INTELLIGENCE

CVE-2021-25108

CVSS score7.1 HIGH
EPSS probability0.45%
CISA KEVNot currently listed
Published2022-02-07
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Description

The IP2Location Country Blocker WordPress plugin before 2.26.6 does not have CSRF check in the ip2location_country_blocker_save_rules AJAX action, allowing attackers to make a logged in admin block arbitrary country, or block all of them at once, preventing users from accessing the frontend.

Weakness classification

  • contact@wpscan.com: CWE-352
  • nvd@nist.gov: CWE-352

Primary references