CVE-2026-82530: IP2Location Country Blocker < 2.45.0 Access Control Bypass via X-Real-IP Header
IP2Location Country Blocker plugin for WordPress before 2.45.0 contains an access control bypass vulnerability that allows unauthenticated remote attackers to circumvent IP-based restrictions by forging the X-Real-IP HTTP header. Attackers can set the X-Real-IP header to an allowlisted IP address to bypass page, link, or site-wide access restrictions and access otherwise-blocked resources.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress IP2Location Country Blockerto a version that resolves this vulnerability.Fixed in 2.45.0 - Compensating control
Temporarily block or strip the X-Real-IP HTTP header at the reverse proxy/WAF (or otherwise ensure it cannot be set by external clients) to prevent bypass of IP-based access restrictions.
Event History
Frequently Asked Questions
Which deployments are exposed to this bypass?
WordPress sites using IP2Location Country Blocker versions before 2.45.0 are affected when they rely on the plugin's IP-based page, link, or site-wide access restrictions.
What does an attacker need to exploit the issue?
An attacker does not need authentication or user interaction. They need to send a remote HTTP request with an X-Real-IP header forged to an IP address that is allowlisted by the target's restrictions.
What can an attacker access after a successful bypass?
The attacker can access resources that would otherwise be blocked by the plugin's IP-based controls, including restricted pages, links, or site-wide content.
How can I determine whether my site is affected?
Check whether IP2Location Country Blocker is installed and whether its version is earlier than 2.45.0. Sites using the plugin to enforce IP-based restrictions should also assess whether requests with a forged X-Real-IP value can reach restricted resources.