The IP2Location Country Blocker plugin for WordPress contains a missing permission check in the admin_init() function. As a result, unauthenticated users can reach the plugin’s settings page and view configuration data, such as country block lists and other options, exposing the site’s blocking configuration. The flaw is classified as an authorization failure (CWE‑285).

All WordPress installations that have any version of the IP2Location Country Blocker plugin up to and including 2.38.8 are affected, regardless of the underlying PHP or WordPress version. No additional prerequisites are required other than the plugin being installed and accessible via its admin interface.

A CVSS score of 7.5 classifies this as high severity, and an EPSS score of 19% indicates a relatively high likelihood of exploitation. The vulnerability is not listed in the CISA KEV database. Based on the description, the likely attack vector is unauthenticated HTTP requests to the admin interface, which would allow retrieval of the plugin settings without authentication.