CVE-2024-32443: IP2Location Country Blocker CSRF Vulnerability

CVE-2024-32443 Overview

CVE-2024-32443 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the IP2Location Country Blocker WordPress plugin. The flaw impacts all versions up to and including 2.34.2. An attacker can craft a malicious web page that, when visited by an authenticated administrator, triggers unauthorized state-changing actions in the plugin without the administrator's consent.

The vulnerability is tracked under CWE-352: Cross-Site Request Forgery. Successful exploitation can lead to modification of plugin settings, including country block rules, which can disrupt site access controls.

Critical Impact
Authenticated administrator interaction with attacker-controlled content can result in unauthorized configuration changes to the Country Blocker plugin, affecting confidentiality, integrity, and availability of the WordPress site.

Affected Products

IP2Location Country Blocker WordPress plugin versions up to and including 2.34.2
WordPress installations with the plugin enabled
Sites relying on Country Blocker for geo-based access restrictions

Discovery Timeline

2024-04-15 - CVE-2024-32443 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-32443

Vulnerability Analysis

The IP2Location Country Blocker plugin fails to validate the origin and authenticity of state-changing HTTP requests. WordPress provides built-in nonce mechanisms (wp_nonce_field() and check_admin_referer()) to protect against CSRF, but the affected plugin code paths do not properly enforce these checks for all sensitive operations.

An attacker hosting a malicious page can include forged requests targeting the plugin's administrative endpoints. When a logged-in WordPress administrator visits the attacker's page, the browser automatically attaches the administrator's session cookies to the forged request. The plugin processes the request as legitimate.

The attack requires user interaction, meaning the administrator must visit the attacker-controlled resource. Because the targeted user holds elevated privileges, the resulting actions inherit those privileges and can modify plugin configuration, blocklists, or related settings.

Root Cause

The root cause is missing or insufficient anti-CSRF token validation on plugin endpoints that perform configuration changes. The plugin trusts the presence of an authenticated session cookie as proof of intent rather than verifying a per-request nonce tied to the administrator's session.

Attack Vector

The attack vector is network-based and requires user interaction. A typical exploitation chain follows these steps:

The attacker identifies vulnerable plugin endpoints and the parameters they accept.
The attacker builds an HTML page containing an auto-submitting form or XMLHttpRequest targeting the WordPress administrative URL of the victim site.
The attacker lures an authenticated WordPress administrator to the page through phishing, social engineering, or comment links.
The victim's browser submits the forged request with valid session cookies, and the plugin executes the action.

No proof-of-concept code is publicly available for this issue. Refer to the Patchstack CSRF Vulnerability Advisory for additional technical context.

Detection Methods for CVE-2024-32443

Indicators of Compromise

Unexpected modifications to Country Blocker plugin settings, blocklists, or whitelists in the WordPress database
HTTP POST requests to plugin administrative endpoints with Referer headers pointing to external domains
Administrator session activity coinciding with visits to untrusted external sites
Audit log entries showing configuration changes without corresponding administrator actions

Detection Strategies

Inspect web server access logs for POST requests to /wp-admin/admin.php?page=ip2location-country-blocker or related plugin URIs with missing or external Referer values
Monitor WordPress audit logs for option changes in the wp_options table tied to the plugin
Correlate browser activity of administrators with subsequent plugin configuration changes
Apply application-layer rules in a Web Application Firewall (WAF) to flag requests without valid WordPress nonces

Monitoring Recommendations

Enable a WordPress audit logging plugin to capture administrative actions and option updates
Forward web server and WordPress logs to a centralized analytics platform for correlation across sessions and source IPs
Alert on plugin option changes occurring outside maintenance windows or from unusual user agents
Track administrator authentication events alongside outbound browsing telemetry where available

How to Mitigate CVE-2024-32443

Immediate Actions Required

Update the IP2Location Country Blocker plugin to a version newer than 2.34.2 as soon as the vendor publishes a fixed release
Audit current plugin configuration and restore any blocklist or whitelist entries that appear unauthorized
Force re-authentication for all WordPress administrators and rotate session keys defined in wp-config.php
Review WordPress audit logs for unexpected configuration changes since plugin installation

Patch Information

Review the Patchstack CSRF Vulnerability Advisory for the latest fixed version information and vendor guidance. The advisory identifies 2.34.2 as the last vulnerable release.

Workarounds

Disable the IP2Location Country Blocker plugin until a patched version is installed
Restrict access to /wp-admin/ by source IP address through web server configuration or a WAF
Require administrators to use separate browsers or browser profiles for WordPress administration
Deploy a WAF rule that blocks POST requests to plugin endpoints lacking a valid WordPress nonce parameter

bash

# Example: restrict /wp-admin/ access to a trusted IP range in nginx
location ^~ /wp-admin/ {
    allow 203.0.113.0/24;
    deny all;
    try_files $uri $uri/ /index.php?$args;
}