CVE-2022-1762 iQ Block Country < 1.2.20 - Protection Bypass due to IP Spoofing
Attackers can bypass IP blocking features in the iQ Block Country WordPress plugin by spoofing HTTP headers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-1762?
CVE-2022-1762 is a high-severity vulnerability in Unknown iQ Block Country, published on 13 Jun 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The iQ Block Country WordPress plugin before 1.2.20 does not properly checks HTTP headers in order to validate the origin IP address, allowing threat actors to bypass it's block feature by spoofing the headers.
Which versions are affected by CVE-2022-1762?
It affects 1 product.
Products include Webence Iq Block Country.
How do I fix CVE-2022-1762?
No fix has been published for CVE-2022-1762 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-1762 being exploited?
There is no known exploitation of CVE-2022-1762 in the wild and no public exploit code.
Other vulnerabilities in Unknown iQ Block Country
- CVE-2021-36873 WordPress iQ Block Country plugin <= 1.2.11 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability
- CVE-2022-41155 WordPress iQ Block Country plugin <= 1.2.18 - Block BYPASS vulnerability
- CVE-2022-0246 iQ Block Country < 1.2.13 - Admin+ Arbitrary File Deletion via Zip Slip
Sources
Also known as GHSA-78xv-3xpm-3hcq.