The vulnerability stems from the Advanced Country Blocker plugin assigning a static, predictable key during installation. Because the key is never changed by default, an attacker can append it to any URL, which the plugin interprets as a valid bypass token. This permits an unauthenticated actor to circumvent the geolocation blocking mechanism, effectively granting them access to content that should be restricted. The weakness is a classic authorization bypass (CWE-1188).

The issue affects the WordPress plugin Advanced Country Blocker developed by brstefanovic. All publicly available releases up to and including version 2.3.1 are susceptible because they include the insecure default secret key logic. No other product versions are listed as affected.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. Attackers could exploit the bypass by appending the default key to any protected URL on a WordPress site running an affected version of the plugin, using a remote, unauthenticated HTTP GET-based vector. The overall risk to an organization is proportional to how many sites have the vulnerable plugin installed.