CVE-2026-82530— IP2Location Country Blocker < 2.45.0 Access Control Bypass via X-Real-IP Header
Quick assessment
Affected
IP2Location IP2Location Country Blocker
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress 的 IP2Location Country Blocker 插件在 2.45.0 版本之前存在访问控制绕过漏洞，允许未认证的远程攻击者通过伪造 HTTP 请求头来绕过基于 IP 的限制。攻击者可以将 请求头设置为允许列表中的 IP 地址，从而绕过针对特定页面、链接或整个站点的访问限制，进而访问原本被阻止的资源。
Possible ATT&CK Techniques 1 AI
T1567.001 · Exfiltration to Code RepositoryAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| IP2Location | IP2Location Country Blocker | < 2.45.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-82530
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
IP2Location Country Blocker < 2.45.0 Access Control Bypass via X-Real-IP Header
Source: CVE Program / CVE List V5
Vulnerability Description
IP2Location Country Blocker plugin for WordPress before 2.45.0 contains an access control bypass vulnerability that allows unauthenticated remote attackers to circumvent IP-based restrictions by forging the X-Real-IP HTTP header. Attackers can set the X-Real-IP header to an allowlisted IP address to bypass page, link, or site-wide access restrictions and access otherwise-blocked resources.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用欺骗进行的认证绕过
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| IP2Location | IP2Location Country Blocker | 0 ~ 2.45.0 | - |
|
II. Public POCs for CVE-2026-82530
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-82530
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-82530 (1)
Vendor Pages for CVE-2026-82530 (1)
IV. Related Vulnerabilities
Same product: IP2Location Country Blocker
-
CVE-2022-50961
WordPress Plugin IP2Location Country Blocker 2.26.7 Stored X -
CVE-2025-1361
IP2Location Country Blocker <= 2.38.8 - Missing Authorizatio -
CVE-2024-22294
WordPress Download IP2Location Country Blocker Plugin <= 2.3 -
CVE-2021-25108
IP2Location Country Blocker < 2.26.6 - Arbitrary Country Ban -
CVE-2021-25096
IP2Location Country Blocker < 2.26.5 - Ban Bypass
Same vendor: IP2Location
-
CVE-2022-50961
WordPress Plugin IP2Location Country Blocker 2.26.7 Stored X -
CVE-2025-39455
WordPress IP2Location Variables plugin <= 2.9.5 - CSRF to Cr -
CVE-2025-32644
WordPress IP2Location World Clock Plugin <= 1.1.9 - CSRF to -
CVE-2025-1502
IP2Location Redirection <= 1.33.3 - Missing Authorization to -
CVE-2025-1361
IP2Location Country Blocker <= 2.38.8 - Missing Authorizatio
Same weakness: CWE-290
-
CVE-2026-82563
Softish C6 Ear Camera and EarVision Android Application Auth -
CVE-2026-62759
Windows Netlogon Spoofing Vulnerability -
CVE-2026-86478
JetBrains YouTrack 授权问题漏洞 -
CVE-2026-84186
Incorrect access control in PrestaShop -
CVE-2026-86196
Grav API Plugin before 1.0.20 Authentication Bypass via Host
V. Comments for CVE-2026-82530
No comments yet