Aaextensions vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Aaextensions products: 1 record(s), with severity, exploitation and fixes.

AA Block country 1

Exploited only (KEV) →

CVE-2025-13694 Medium · 5.3 CWE-348 Jan 7, 2026

AA Block country <= 1.0.1 - Unauthenticated IP Address Spoofing via X-Forwarded-For Header

The AA Block Country plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 1.0.1. This is due to the plugin trusting user-supplied headers such as HTTP_X_FORWARDED_FOR to determine the client's IP address without proper validation or considering if the server is behind a trusted proxy. This makes it possible for unauthenticated attackers to bypass IP-based access restrictions by spoofing their IP address via the X-Forwarded-For header.