The AA Block Country plugin for WordPress accepts the X-Forwarded-For header as a literal source of the client IP address without verifying that the request came through a trusted proxy. An unauthenticated attacker can inject an arbitrary value into this header, causing the plugin to believe the request originates from a whitelisted IP address and thereby bypass IP‑based access restrictions. This flaw falls under CWE‑348 and can lead to unauthorized access to restricted content or functionality on the site, creating a moderate level of security risk.

Vulnerable systems are WordPress installations that have the aaextensions AA Block Country plugin installed on a version 1.0.1 or earlier. The plugin is responsible for blocking traffic from specific countries or IP ranges, so compromise of its IP determination logic directly undermines its filtering capability.

The CVSS score of 5.3 categorizes the risk as moderate while the EPSS score of less than 1% suggests the likelihood of automated exploitation is low at present. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be via an HTTP request that supplies a forged X-Forwarded-For header; because no user authentication is required, any visitor can craft such a request and benefit from the privilege escalation.