The IP2Location Country Blocker plugin for WordPress contains a missing capability check in the admin_init() function, allowing unauthenticated attackers to access the plugin’s settings page. This results in a Regular Information Exposure vulnerability rather than code execution. The exposed information may include configuration options and potentially sensitive data such as country block lists, which could be leveraged to facilitate further attacks or compromise site integrity. The weakness is a classic Authorization check failure, formally identified as CWE-285.

WordPress sites that have installed any version of the IP2Location Country Blocker plugin up to and including 2.38.8 are affected. The vulnerability is consistent across all affected releases; no specific PHP or WordPress version causes additional risk beyond the plugin’s version constraint.

The CVSS score of 7.5 indicates high severity, and the EPSS score of less than 1% suggests that exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is unauthenticated HTTP requests to the plugin’s admin endpoint, as the authorization check is absent. An attacker can simply visit or probe the settings page to retrieve configuration data.