CVE-2024-22294 WordPress Download IP2Location Country Blocker Plugin <= 2.33.3 is vulnerable to Sensitive Data Exposure
An attacker can access sensitive information from the IP2Location Country Blocker WordPress plugin without authorization.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-22294?
CVE-2024-22294 is a medium-severity vulnerability in IP2Location Country Blocker, published on 24 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in IP2Location IP2Location Country Blocker.This issue affects IP2Location Country Blocker: from n/a through 2.33.3.
Weakness: CWE-200
Which versions are affected by CVE-2024-22294?
It affects 1 product.
Products include Ip2location Country Blocker.
How do I fix CVE-2024-22294?
No fix has been published for CVE-2024-22294 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-22294 being exploited?
There is no known exploitation of CVE-2024-22294 in the wild and no public exploit code.
Other vulnerabilities in IP2Location Country Blocker
- CVE-2025-1361 Missing authorization in IP2Location Country Blocker
- CVE-2021-25095 IP2Location Country Blocker < 2.26.5 - Subscriber+ Arbitrary Country Ban
- CVE-2021-25108 IP2Location Country Blocker < 2.26.6 - Arbitrary Country Ban via CSRF
- CVE-2021-25096 IP2Location Country Blocker < 2.26.5 - Ban Bypass
- CVE-2025-24731 WordPress IP2Location Country Blocker plugin <= 2.38.3 - Cross Site Scripting (XSS) vulnerability
Sources
Also known as GHSA-v6qc-f595-6qvv.