CVE-2026-1675

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1675", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-30T01:48:15.248Z", "datePublished": "2026-02-07T08:26:37.529Z", "dateUpdated": "2026-04-08T16:44:50.385Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:44:50.385Z"}, "affected": [{"vendor": "brstefanovic", "product": "Advanced Country Blocker", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.3.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Advanced Country Blocker plugin for WordPress is vulnerable to Authorization Bypass in all versions up to, and including, 2.3.1 due to the use of a predictable default value for the secret bypass key created during installation without requiring users to change it. This makes it possible for unauthenticated attackers to bypass the geolocation blocking mechanism by appending the key to any URL on sites where the administrator has not changed the default value."}], "title": "Advanced Country Blocker <= 2.3.1 - Unauthenticated Authorization Bypass via Insecure Default Secret Key", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/30747988-83f9-41f9-9bc5-1f533bc4cb94?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/advanced-country-blocker/tags/2.3.1/advanced-country-blocking.php#L278"}, {"url": "https://plugins.trac.wordpress.org/browser/advanced-country-blocker/tags/2.3.1/advanced-country-blocking.php#L336"}, {"url": "https://plugins.trac.wordpress.org/browser/advanced-country-blocker/tags/2.3.1/advanced-country-blocking.php#L420"}, {"url": "https://plugins.trac.wordpress.org/changeset/3455225/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-1188 Initialization of a Resource with an Insecure Default", "cweId": "CWE-1188", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Hector Flores"}], "timeline": [{"time": "2026-02-06T20:24:09.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-11T15:41:21.639323Z", "id": "CVE-2026-1675", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-11T15:46:18.830Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1675", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-11T15:41:21.639323Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-11T15:41:22.259Z"}}], "cna": {"title": "Advanced Country Blocker <= 2.3.1 - Unauthenticated Authorization Bypass via Insecure Default Secret Key", "credits": [{"lang": "en", "type": "finder", "value": "Hector Flores"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "brstefanovic", "product": "Advanced Country Blocker", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "2.3.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-06T20:24:09.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/30747988-83f9-41f9-9bc5-1f533bc4cb94?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/advanced-country-blocker/tags/2.3.1/advanced-country-blocking.php#L278"}, {"url": "https://plugins.trac.wordpress.org/browser/advanced-country-blocker/tags/2.3.1/advanced-country-blocking.php#L336"}, {"url": "https://plugins.trac.wordpress.org/browser/advanced-country-blocker/tags/2.3.1/advanced-country-blocking.php#L420"}], "descriptions": [{"lang": "en", "value": "The Advanced Country Blocker plugin for WordPress is vulnerable to Authorization Bypass in all versions up to, and including, 2.3.1 due to the use of a predictable default value for the secret bypass key created during installation without requiring users to change it. This makes it possible for unauthenticated attackers to bypass the geolocation blocking mechanism by appending the key to any URL on sites where the administrator has not changed the default value."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1188", "description": "CWE-1188 Initialization of a Resource with an Insecure Default"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-02-07T08:26:37.529Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1675", "state": "PUBLISHED", "dateUpdated": "2026-02-11T15:46:18.830Z", "dateReserved": "2026-01-30T01:48:15.248Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-07T08:26:37.529Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Advanced Country Blocker", "vendor": "brstefanovic", "versions": [{"lessThanOrEqual": "2.3.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Advanced Country Blocker plugin for WordPress is vulnerable to Authorization Bypass in all versions up to, and including, 2.3.1 due to the use of a predictable default value for the secret bypass key created during installation without requiring users to change it. This makes it possible for unauthenticated attackers to bypass the geolocation blocking mechanism by appending the key to any URL on sites where the administrator has not changed the default value."}, {"lang": "es", "value": "El plugin Advanced Country Blocker para WordPress es vulnerable a un bypass de autorizaci\u00f3n en todas las versiones hasta la 2.3.1, inclusive, debido al uso de un valor predeterminado predecible para la clave secreta de bypass creada durante la instalaci\u00f3n sin requerir que los usuarios la cambien. Esto hace posible que atacantes no autenticados omitan el mecanismo de bloqueo por geolocalizaci\u00f3n al a\u00f1adir la clave a cualquier URL en sitios donde el administrador no ha cambiado el valor predeterminado."}], "id": "CVE-2026-1675", "lastModified": "2026-06-17T10:16:17.947", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1675", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-11T15:41:21.639323Z", "version": "2.0.3"}}]}, "published": "2026-02-07T09:16:01.230", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/advanced-country-blocker/tags/2.3.1/advanced-country-blocking.php#L278"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/advanced-country-blocker/tags/2.3.1/advanced-country-blocking.php#L336"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/advanced-country-blocker/tags/2.3.1/advanced-country-blocking.php#L420"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3455225/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/30747988-83f9-41f9-9bc5-1f533bc4cb94?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1188"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-15T21:21:04.173628+00:00", "value": {"mitigation_remediation": ["Upgrade the Advanced Country Blocker plugin to a non\u2011vulnerable version (e.g., 2.3.2 or later).", "If an immediate upgrade is not possible, set a unique, random secret bypass key in the plugin\u2019s settings to replace the default value.", "Configure the web server or a WAF to block requests that include the bypass key parameter when the default key is still present (e.g., deny URLs containing the known default key)."], "summary": {"action": "Apply Patch", "impact": "Authorization Bypass"}, "threat_synthesis": {"affected_systems": "The issue affects the WordPress plugin Advanced Country Blocker developed by brstefanovic. All publicly available releases up to and including version 2.3.1 are susceptible because they include the insecure default secret key logic. No other product versions are listed as affected.", "description_and_impact": "The vulnerability stems from the Advanced Country Blocker plugin assigning a static, predictable key during installation. Because the key is never changed by default, an attacker can append it to any URL, which the plugin interprets as a valid bypass token. This permits an unauthenticated actor to circumvent the geolocation blocking mechanism, effectively granting them access to content that should be restricted. The weakness is a classic authorization bypass (CWE-1188).", "risk_and_exploitability": "The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in CISA\u2019s Known Exploited Vulnerabilities catalog. Attackers could exploit the bypass by appending the default key to any protected URL on a WordPress site running an affected version of the plugin, using a remote, unauthenticated HTTP GET-based vector. The overall risk to an organization is proportional to how many sites have the vulnerable plugin installed."}}}}, "created": "2026-02-09T10:44:38.160944+00:00", "updated": "2026-04-15T21:30:13.892649+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}