CVE-2026-82530 | BDVDB-2026-370754 Detail

Description#

IP2Location Country Blocker plugin for WordPress before 2.45.0 contains an access control bypass vulnerability that allows unauthenticated remote attackers to circumvent IP-based restrictions by forging the X-Real-IP HTTP header. Attackers can set the X-Real-IP header to an allowlisted IP address to bypass page, link, or site-wide access restrictions and access otherwise-blocked resources.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-09-09Record published in the CVE List.
2. Version 22026-10-01Most recent update recorded in the CVE List.