CVE-2026-1675

The record

The Advanced Country Blocker plugin for WordPress is vulnerable to Authorization Bypass in all versions up to, and including, 2.3.1 due to the use of a predictable default value for the secret bypass key created during installation without requiring users to change it. This makes it possible for unauthenticated attackers to bypass the geolocation blocking mechanism by appending the key to any URL on sites where the administrator has not changed the default value.

Affected packages

Related vulnerabilities

• CVE-2026-116247 When a server in pgAdmin 4 had no password file, client certificate or client key… CWE-1188
• CVE-2026-116244 When a pgAdmin 4 connection was not meant to use a Kerberos user's delegated credentials… CWE-1188
• CVE-2026-116242 pgAdmin 4 opens SSH tunnels with the sshtunnel library but gave it neither… CWE-1188
• CVE-2026-112255 Initialization of a resource with an insecure default vulnerability in OpenText Advanced… CWE-1188
• CVE-2026-118691 xianyu-auto-reply-fix through 2.0.7 contains a missing authorization vulnerability in the… CWE-1188
• CVE-2026-116273 MIME::Parser versions before 5.521 for Perl set no limit on the number of message parts… CWE-1188
• CVE-2026-110952 A Kafka broker that authenticates clients with SASL/OAUTHBEARER using the bundled… CWE-1188
• CVE-2026-116672 Authlib is a Python library which builds OAuth and OpenID Connect servers. CWE-1188