CVE-2022-1762

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The iQ Block Country WordPress plugin before 1.2.20 does not properly checks HTTP headers in order to validate the origin IP address, allowing threat actors to bypass it's block feature by spoofing the headers.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected software

Vendor	Product	Versions
Unknown	iQ Block Country	< 1.2.20

References

https://wpscan.com/vulnerability/03254977-37cc-4365-979b-326f9637be85Exploit, Third Party Advisory
https://wpscan.com/vulnerability/03254977-37cc-4365-979b-326f9637be85Exploit, Third Party Advisory

Timeline

Published: Jun 13, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-17635.4Due to missing checks the Static Page eXtended WordPress plugin through 2.1 is vulnerable to CSRF attacks which allows changing the plugin s CVE-2022-17645.4The WP-chgFontSize WordPress plugin through 1.8 does not have CSRF check in place when updating its settings, which could allow attackers to CVE-2022-17658.8The Hot Linked Image Cacher WordPress plugin through 1.16 is vulnerable to CSRF. This can be used to store / cache images from external doma CVE-2022-17667.5Anchore Enterprise anchorectl version 0.1.4 improperly stored credentials when generating a Software Bill of Materials. anchorectl will add CVE-2022-17677.5Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.7.CVE-2022-17687.5The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to insufficient escaping and parameterization on user CVE-2022-17697.8Buffer Over-read in GitHub repository vim/vim prior to 8.2.4974.CVE-2022-17708.8Improper Privilege Management in GitHub repository polonel/trudesk prior to 1.2.2.CVE-2022-17715.5Uncontrolled Recursion in GitHub repository vim/vim prior to 8.2.4975.CVE-2022-17724.8The Google Places Reviews WordPress plugin before 2.0.0 does not properly escape its Google API key setting, which is reflected on the site'CVE-2022-17736.1The WP Athletics WordPress plugin through 1.1.7 does not sanitise and escape a parameter before outputting back in an admin page, leading to CVE-2022-17746.1Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.0.7.