High severity7.1NVD Advisory· Published Feb 7, 2022· Updated Jun 17, 2026

CVE-2021-25108

Description

The IP2Location Country Blocker WordPress plugin before 2.26.6 does not have CSRF check in the ip2location_country_blocker_save_rules AJAX action, allowing attackers to make a logged in admin block arbitrary country, or block all of them at once, preventing users from accessing the frontend.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Ip2location Country Blockercpe-rescue2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: < 2.26.6
Package: https://wordpress.org/plugins/ip2location-country-blocker

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/changeset/2653459nvdPatchThird Party Advisory
wpscan.com/vulnerability/9d416ca3-bd02-4fcf-b3b8-f2f2280d02d2nvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.461
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000