CVE-2021-25108

Name of the Vulnerable Software and Affected Versions IP2Location Country Blocker WordPress plugin versions prior to 2.26.6

Description The issue concerns a lack of CSRF check in the ip2location country blocker save rules AJAX action. This allows attackers to make a logged-in admin block arbitrary countries or all of them at once, preventing users from accessing the frontend.

Recommendations For versions prior to 2.26.6, update to version 2.26.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the ip2location country blocker save rules AJAX action to minimize the risk of exploitation.