CVE-2026-82530 describes an authentication bypass vulnerability in the IP2Location Country Blocker WordPress plugin prior to version 2.45.0. The vulnerability arises because the plugin relies on the X-Real-IP HTTP header for IP-based access control without proper validation. Attackers can forge this header to impersonate an allowlisted IP address, circumventing restrictions and gaining unauthorized access to protected content. This issue does not require authentication, user interaction, or privileges to exploit.

Successful exploitation allows unauthenticated attackers to bypass IP-based access controls implemented by the plugin. This can lead to unauthorized access to restricted pages, links, or entire site content that is otherwise blocked based on geographic IP filtering. The impact is limited to access control bypass without direct code execution or data corruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling the plugin or implementing additional server-side IP validation that does not rely solely on the X-Real-IP header. Monitoring and filtering HTTP headers at the web server or application firewall level may help mitigate spoofing attempts.