title: IP2Location Country Blocker < 2.26.6 - Arbitrary Country Ban via CSRF
description: The IP2Location Country Blocker WordPress plugin before 2.26.6 does not have CSRF check in the ip2location_country_blocker_save_rules AJAX action, allowing attackers to make a logged in admin block arbitrary country, or block all of them at once, preventing users from accessing the frontend.
problem types: CWE-352 Cross-Site Request Forgery (CSRF)
affected:
{
product: IP2Location Country Blocker
vendor: Unknown
versions:
lessThan: 2.26.6, status: affected, version: 2.26.6, versionType: custom
}