AA Block Country WordPress Plugin IP Address Spoofing Vulnerability

A vulnerability allowing IP address spoofing has been identified in the AA Block Country plugin for WordPress, affecting versions through 1.0.1. The issue arises because the plugin relies on user-supplied headers, such as X-Forwarded-For, to determine the client's IP address. This approach lacks proper validation and does not account for whether the server is behind a trusted proxy. As a result, unauthenticated attackers can bypass IP-based access restrictions by spoofing their IP addresses via the X-Forwarded-For header.

Impact

Exploitation of this vulnerability could allow unauthenticated users to bypass IP-based access controls, potentially leading to unauthorized access or actions on the WordPress site.