CVE-2025-13694mediumCWE-348

CVE-2025-13694: falha de média gravidade em aaextensions AA Block country

AA Block country <= 1.0.1 - Unauthenticated IP Address Spoofing via X-Forwarded-For Header

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar AA Block country

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.2%
The AA Block Country plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 1.0.1. This is due to the plugin trusting user-supplied headers such as HTTP_X_FORWARDED_FOR to determine the client's IP address without proper validation or considering if the server is behind a trusted proxy. This makes it possible for unauthenticated attackers to bypass IP-based access restrictions by spoofing their IP address via the X-Forwarded-For header.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
aaextensions · AA Block country