CVE-2026-82530CWE-290

CVE-2026-82530

Medium · published September 9, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
37.6
In the wild
Unconfirmed
What it is

IP2Location Country Blocker plugin for WordPress before 2.45.0 contains an access control bypass vulnerability that allows unauthenticated remote attackers to circumvent IP-based restrictions by forging the X-Real-IP HTTP header. Attackers can set the X-Real-IP header to an allowlisted IP address to bypass page, link, or site-wide access restrictions and access otherwise-blocked resources.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00443 · 37.6th percentile
Weakness
CWE-290 · Authentication Bypass by Spoofing
Published
2026-09-09T19:17Z
References (2)
https://wordpress.org/plugins/ip2location-country-blocker/#developers · [email protected]https://www.vulncheck.com/advisories/ip2location-country-blocker-access-control-bypass-via-x-real-ip-header · [email protected]
EPSS history
Timeline
  • 11 SEP 03:19Z
    EPSS moved — → 0%
    epss
  • 09 SEP 14:10Z
    IP2Location Country Blocker < 2.45.0 Access Control Bypass via X-Real-IP Header
    cvelistv5