CVE-2025-13694 affects the AA Block Country plugin for WordPress, which improperly trusts the HTTP_X_FORWARDED_FOR header to determine client IP addresses. This lack of validation allows attackers to spoof IP addresses and bypass IP-based restrictions. The vulnerability is categorized under CWE-348 (Use of Less Trusted Source) and impacts versions up to and including 1.0.1. The CVSS 3.1 base score is 5.3, indicating a medium severity network attack vector with no required privileges or user interaction. No known exploits are reported in the wild, and no vendor patch or advisory is currently available.

Attackers can bypass IP-based access controls implemented by the AA Block Country plugin by spoofing the X-Forwarded-For header. This could allow unauthorized access or evasion of IP restrictions, potentially undermining security policies relying on IP filtering. There is no direct impact on confidentiality or availability reported, only integrity of IP-based access control is affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider disabling the plugin or implementing additional server-side validation of client IP addresses, such as verifying trusted proxy headers or using alternative methods to determine client IP. Avoid relying solely on user-supplied headers for security decisions.