CVE-2025-1361highCWE-285

CVE-2025-1361: fallo de gravedad alta en IP2Location Country Blocker

IP2Location Country Blocker <= 2.38.8 - Missing Authorization to Unauthenticated Information Exposure via admin_init Function

Publicada el · Actualizada el

36Vexday Risk Score

Corrige pronto. Ella tiene exploit funcional público.

ssvc Attendcvss 7.5epss 1.3%
probabilidad de explotación
1.3%top 30% de las CVE
explotación observada
noninguna fuente lo reporta
The IP2Location Country Blocker plugin for WordPress is vulnerable to Regular Information Exposure in all versions up to, and including, 2.38.8 due to missing capability checks on the admin_init() function. This makes it possible for unauthenticated attackers to view the plugin's settings.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Productos afectados
ip2location · IP2Location Country Blocker
Referencias
https://plugins.trac.wordpress.org/browser/ip2location-country-blocker/trunk/ip2location-country-blocker.php#L114https://plugins.trac.wordpress.org/changeset/3244193/https://wordpress.org/plugins/ip2location-country-blocker/#developershttps://www.wordfence.com/threat-intel/vulnerabilities/id/b63bc2b6-1abc-4cfa-a7e5-3995640f66a7?source=cve