CVE-2025-1361 Overview
CVE-2025-1361 is an information exposure vulnerability in the IP2Location Country Blocker plugin for WordPress. The flaw affects all versions up to and including 2.38.8. The plugin's admin_init() function lacks capability checks, allowing unauthenticated attackers to read the plugin's settings over the network. The issue is categorized under [CWE-285] Improper Authorization and [CWE-862] Missing Authorization.
Critical Impact
Unauthenticated remote attackers can retrieve plugin configuration data, including country blocking rules and related settings, which can aid reconnaissance and bypass planning against protected WordPress sites.
Affected Products
- IP2Location Country Blocker for WordPress versions <= 2.38.8
- WordPress installations with the plugin active
- Sites relying on the plugin for geolocation-based access control
Discovery Timeline
- 2025-02-22 - CVE-2025-1361 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-1361
Vulnerability Analysis
The IP2Location Country Blocker plugin registers administrative actions through the WordPress admin_init hook. The registered handler executes without validating the caller's WordPress capability or verifying a nonce. As a result, any HTTP request that triggers the admin_init action can invoke logic that reads plugin settings and returns them in the response.
Because the vulnerability requires no authentication and no user interaction, an attacker only needs network access to the target WordPress site. The attacker sends a crafted request to a WordPress admin-facing endpoint that fires admin_init, and the plugin exposes its stored configuration. The disclosed data can include allowed and blocked country codes, redirect targets, and other operational parameters used by the plugin.
The scope is limited to confidentiality; the flaw does not directly allow modification of settings or code execution. However, exposed configuration can inform follow-on attacks, such as choosing source IPs that evade country blocks or identifying misconfigurations. Additional context is available in the Wordfence Vulnerability Report.
Root Cause
The admin_init() function in ip2location-country-blocker.php does not call current_user_can() or an equivalent capability check before performing privileged read operations. WordPress fires admin_init on a broad set of admin-context requests, some of which are reachable by unauthenticated users. The WordPress Plugin Code Reference shows the affected handler.
Attack Vector
An unauthenticated attacker issues an HTTP request to the target site that triggers the plugin's admin_init handler. No credentials, tokens, or user interaction are required. The response, or a subsequent request derived from it, reveals the plugin's settings. The vulnerability has an EPSS probability of 1.278% (66.6 percentile).
No verified public exploit code is available. The vulnerability mechanism is documented in the vendor changeset and third-party advisory linked above.
Detection Methods for CVE-2025-1361
Indicators of Compromise
- Unauthenticated HTTP requests to wp-admin/admin-ajax.php or other admin endpoints originating from unusual IP ranges.
- Web server logs showing anonymous access to routes that invoke the admin_init hook on the IP2Location Country Blocker plugin.
- Repeated GET or POST requests probing plugin-specific parameters from a single source.
Detection Strategies
- Inventory WordPress sites and identify installations running IP2Location Country Blocker versions <= 2.38.8.
- Enable verbose access logging on WordPress admin endpoints and correlate anonymous sessions with responses containing plugin option keys.
- Deploy a Web Application Firewall (WAF) rule that flags unauthenticated requests reaching plugin admin handlers.
Monitoring Recommendations
- Alert on HTTP 200 responses to unauthenticated requests targeting admin-ajax.php with parameters referencing ip2location or country_blocker.
- Track outbound reconnaissance patterns following plugin settings exposure, such as scripted requests testing country-based access controls.
- Monitor plugin version metadata across managed WordPress fleets to detect out-of-date installations.
How to Mitigate CVE-2025-1361
Immediate Actions Required
- Update the IP2Location Country Blocker plugin to a version above 2.38.8 as published in the vendor changeset.
- Audit WordPress sites for the presence of the vulnerable plugin and prioritize patching public-facing instances.
- Rotate any secrets or configuration values that may have been exposed through the plugin's settings.
Patch Information
The vendor addressed the missing capability check in the plugin trunk. Details of the code change are available in the WordPress Changeset History. Site administrators should apply the fixed release through the WordPress plugin updater or by pulling the current version from the WordPress Plugin Developer Info page.
Workarounds
- Deactivate the IP2Location Country Blocker plugin until the patched version is applied.
- Restrict access to /wp-admin/ paths at the network or WAF layer to authenticated administrators.
- Add a custom capability check via a mu-plugin that terminates unauthenticated calls to the plugin's admin_init handler until the official patch is in place.
# Configuration example: verify installed plugin version via WP-CLI
wp plugin get ip2location-country-blocker --field=version
wp plugin update ip2location-country-blocker
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
