CVE-2021-25108: IP2LOCATION Country Blocker

High severity, CVSS 7.1. EPSS: 0.5% chance of exploitation in the next 30 days.

The IP2Location Country Blocker WordPress plugin before 2.26.6 does not have CSRF check in the ip2location_country_blocker_save_rules AJAX action, allowing attackers to make a logged in admin block arbitrary country, or block all of them at once, preventing users from accessing the frontend.

Affected products

• IP2LOCATION Country Blocker: before 2.26.6 (fixed in 2.26.6)

Published 2022-02-07. Last modified 2026-06-17.