CVE-2025-13694CWE-348

AA Block country <= 1.0.1 - Unauthenticated IP Address Spoofing via X-Forwarded-For Header

Medium · published January 7, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
12.8
In the wild
Unconfirmed
What it is

The AA Block Country plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 1.0.1. This is due to the plugin trusting user-supplied headers such as HTTP_X_FORWARDED_FOR to determine the client's IP address without proper validation or considering if the server is behind a trusted proxy. This makes it possible for unauthenticated attackers to bypass IP-based access restrictions by spoofing their IP address via the X-Forwarded-For header.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00228 · 12.8th percentile
Weakness
CWE-348 · Use of Less Trusted Source
Published
2026-01-07T09:20Z
EPSS history
Timeline
  • 07 JAN 09:20Z
    AA Block country <= 1.0.1 - Unauthenticated IP Address Spoofing via X-Forwarded-For Header
    cvelistv5