CVE-2026-82530
Medium
Description
IP2Location Country Blocker plugin for WordPress before 2.45.0 contains an access control bypass vulnerability that allows unauthenticated remote attackers to circumvent IP-based restrictions by forging the X-Real-IP HTTP header. Attackers can set the X-Real-IP header to an allowlisted IP address to bypass page, link, or site-wide access restrictions and access otherwise-blocked resources.
SeverityMedium
CVSS5.3
Exploit probability—
ProductIP2Location Country Blocker
PublishedSep 9, 2026
First seenSep 9, 2026
Weakness typeCWE-290CWE-290
How to fix
Update
- IP2Location IP2Location Country Blocker2.45.0 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| IP2Location IP2Location Country Blocker | v < 2.45.0 | 2.45.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.