CVE-2024-32443: 
WordPress vulnerability analysis and mitigation

A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the WordPress IP2Location Country Blocker plugin, affecting versions up to and including 2.34.2. The vulnerability was disclosed on April 12, 2024, and was assigned CVE-2024-32443. The issue stems from missing or incorrect nonce validation in the validate_api_key() function (WPScan).

The vulnerability is classified as a Cross-Site Request Forgery (CSRF) with a CVSS v3.1 base score of 4.3 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. The issue is tracked under CWE-352 (Cross-Site Request Forgery) and primarily affects the validate_api_key() function in the plugin (Patchstack).

The vulnerability allows unauthenticated attackers to replace the API key via a forged request if they can trick a site administrator into performing specific actions, such as clicking on a malicious link (WPScan).

The vulnerability requires user interaction and has been classified as having low complexity to exploit. An unauthenticated attacker can potentially exploit this vulnerability through social engineering tactics to trick administrators into performing specific actions (Patchstack).

The vulnerability has been fixed in version 2.34.3 of the IP2Location Country Blocker plugin. Users are advised to update to this version or later to remove the vulnerability (Patchstack).