CVE-2022-41650: Custom Content by Country Auth Bypass Flaw

CVE-2022-41650 Overview

CVE-2022-41650 is a Missing Authorization vulnerability [CWE-862] in the WordPress plugin Custom Content by Country (by Shield Security), developed by Paul. The flaw affects plugin versions from n/a through 3.1.2. Unauthenticated attackers can reach functionality that should be restricted to authorized users, resulting in broken access control. The issue is exploitable over the network with low attack complexity and requires no user interaction.

Critical Impact
Network-reachable broken access control in the Custom Content by Country WordPress plugin (≤ 3.1.2) allows unauthenticated attackers to invoke restricted plugin functionality, impacting integrity and availability.

Affected Products

Custom Content by Country (by Shield Security) WordPress plugin
All versions through 3.1.2
WordPress sites with the custom-content-by-country plugin installed and active

Discovery Timeline

2026-02-17 - CVE-2022-41650 published to NVD
2026-04-28 - Last updated in NVD database

Technical Details for CVE-2022-41650

Vulnerability Analysis

The vulnerability is classified under [CWE-862] Missing Authorization. The plugin exposes one or more actions or endpoints without verifying that the requesting user holds the required capability or role. As a result, an attacker can invoke privileged plugin operations without prior authentication.

Because the attack vector is network-based and requires no privileges or user interaction, an attacker only needs the ability to send HTTP requests to the target WordPress site. The impact is scoped to limited integrity and availability effects on plugin-controlled data, with no direct impact on confidentiality per the CVSS vector.

Root Cause

The root cause is the absence of proper authorization checks on plugin handlers. WordPress plugins typically protect privileged actions using current_user_can() capability checks and nonce verification via check_admin_referer() or wp_verify_nonce(). In the affected releases of custom-content-by-country, at least one handler reachable through the WordPress request lifecycle does not enforce these checks before performing state-changing operations.

Attack Vector

An unauthenticated remote attacker sends crafted HTTP requests to the WordPress site hosting the vulnerable plugin. The attacker targets the plugin's exposed endpoints, such as admin-ajax.php actions or registered REST routes, that lack capability validation. Successful exploitation allows the attacker to trigger functionality that should be restricted to authenticated, privileged users. No verified public exploit or proof-of-concept code is currently available. For technical context, see the Patchstack Vulnerability Report.

Detection Methods for CVE-2022-41650

Indicators of Compromise

Unexpected POST requests to wp-admin/admin-ajax.php referencing plugin actions tied to custom-content-by-country.
Modifications to plugin configuration or country-based content rules without a corresponding authenticated administrator session.
Anomalous traffic from unauthenticated sources targeting plugin-specific REST routes or AJAX actions.

Detection Strategies

Inspect WordPress access logs for requests to plugin endpoints lacking a valid wordpress_logged_in_* cookie.
Enable WordPress audit logging to record plugin setting changes and correlate against authenticated user activity.
Deploy a Web Application Firewall (WAF) rule set that flags requests to known vulnerable plugin handlers.

Monitoring Recommendations

Track installed plugin versions across the WordPress estate and alert on any installation of custom-content-by-country at version 3.1.2 or earlier.
Monitor for spikes in 200-status responses to admin-ajax.php from unauthenticated source IPs.
Forward web server and WordPress audit logs to a centralized SIEM for correlation and retention.

How to Mitigate CVE-2022-41650

Immediate Actions Required

Identify all WordPress sites running the Custom Content by Country plugin at version 3.1.2 or earlier.
Update the plugin to a fixed release as provided by the vendor, or deactivate and remove the plugin if no patch is applied.
Restrict administrative access to WordPress by enforcing strong authentication and IP allowlists where feasible.

Patch Information

The vulnerability affects Custom Content by Country versions through 3.1.2. Administrators should consult the Patchstack Vulnerability Report and the WordPress plugin repository for the latest fixed version and upgrade instructions.

Workarounds

Deactivate the custom-content-by-country plugin until a verified patched version is installed.
Apply WAF rules that block unauthenticated requests to plugin-specific AJAX actions and REST routes.
Limit access to /wp-admin/ and admin-ajax.php using server-level controls such as HTTP authentication or IP restrictions where operationally acceptable.

bash

# Example: list and disable the vulnerable plugin using WP-CLI
wp plugin list --name=custom-content-by-country --fields=name,status,version
wp plugin deactivate custom-content-by-country