CVE-2025-1361 – The IP2Location Country Blocker WordPress plugi... (How to Fix)

Q: What is the severity of CVE-2025-1361?

CVE-2025-1361 has a CVSS score of 7.5 (HIGH). The IP2Location Country Blocker WordPress plugin exposes sensitive configuration settings to unauthenticated users due to missing capability checks. This allows attackers to view plugin settings without authentication. All WordPress sites using this plugin up to version 2.38.8 are affected.

📋 TL;DR

The IP2Location Country Blocker WordPress plugin exposes sensitive configuration settings to unauthenticated users due to missing capability checks. This allows attackers to view plugin settings without authentication. All WordPress sites using this plugin up to version 2.38.8 are affected.

💻 Affected Systems

Products:

IP2Location Country Blocker WordPress Plugin

Versions: All versions up to and including 2.38.8

Operating Systems: Any OS running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: All WordPress installations with the vulnerable plugin version are affected regardless of configuration.

📦 What is this software?

Country Blocker by Ip2location

View all CVEs affecting Country Blocker →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could learn country blocking rules, IP ranges, and security configurations, enabling them to bypass geographic restrictions or plan targeted attacks.

🟠

Likely Case

Unauthenticated users can view plugin settings including blocked countries, whitelisted IPs, and security configurations.

🟢

If Mitigated

With proper access controls, only authenticated administrators can view plugin settings.

🌐 Internet-Facing: HIGH - The vulnerability affects internet-facing WordPress sites and requires no authentication.

🏢 Internal Only: LOW - This primarily affects public-facing WordPress installations.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires sending HTTP requests to specific admin endpoints without authentication.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2.38.9 or later

Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3244193/

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'IP2Location Country Blocker'. 4. Click 'Update Now' if available. 5. Alternatively, download version 2.38.9+ from WordPress.org and replace the plugin files.

🔧 Temporary Workarounds

Disable vulnerable plugin

WordPress

Temporarily disable the IP2Location Country Blocker plugin until patched

wp plugin deactivate ip2location-country-blocker

Restrict admin endpoint access

all

Use web application firewall or .htaccess to block unauthenticated access to /wp-admin/admin.php endpoints

🧯 If You Can't Patch

Disable the IP2Location Country Blocker plugin completely
Implement network-level restrictions to block access to WordPress admin endpoints from untrusted sources

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin → Plugins → Installed Plugins for IP2Location Country Blocker version. If version is 2.38.8 or lower, you are vulnerable.

Check Version:

wp plugin get ip2location-country-blocker --field=version

Verify Fix Applied:

After updating, verify the plugin version shows 2.38.9 or higher in WordPress admin panel.

📡 Detection & Monitoring

Log Indicators:

Unusual GET requests to /wp-admin/admin.php?page=ip2location-country-blocker from unauthenticated IPs
Multiple failed authentication attempts followed by admin endpoint access

Network Indicators:

HTTP requests to admin endpoints without authentication cookies or tokens
Traffic patterns showing information gathering from admin interfaces

SIEM Query:

source="wordpress.log" AND (uri="/wp-admin/admin.php" AND parameters CONTAINS "ip2location-country-blocker") AND NOT (user_agent CONTAINS "WordPress" OR cookie CONTAINS "wordpress_logged_in")

📊 Metadata

CVE ID: CVE-2025-1361

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE: CWE-285

EPSS Score: 0.45% exploit probability (63.2th percentile)

Published: February 22, 2025

Last Updated: March 6, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-1361, you might also want to check these: