CVE-2025-13694

The record

The AA Block Country plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 1.0.1. This is due to the plugin trusting user-supplied headers such as HTTP_X_FORWARDED_FOR to determine the client's IP address without proper validation or considering if the server is behind a trusted proxy. This makes it possible for unauthenticated attackers to bypass IP-based access restrictions by spoofing their IP address via the X-Forwarded-For header.

Affected packages

Related vulnerabilities

• CVE-2026-119711 PipesHub before 0.10.0 contains a rate limit bypass vulnerability in getClientIp() that… CWE-348
• CVE-2026-118265 Echo is a Go web framework. CWE-348
• CVE-2026-112378 GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before… CWE-348
• CVE-2026-114474 Use of a less trusted source for the envelope sender in the external-account download of… CWE-348
• CVE-2026-114437 In the Golang Chi web framework, the ClientIPFromXFF middleware skips any X-Forwarded-For… CWE-348
• CVE-2026-111934 Coder before 2.34.7 contains an IP spoofing vulnerability in the ExtractRealIPAddress… CWE-348
• CVE-2026-102275 PyJWT is a Python implementation of JSON Web Token standards. CWE-348
• CVE-2026-90711 proxy-addr is a Node.js module that determines a request's client address behind trusted… CWE-348