IP2Location Variables

IP2Location Variables has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of September 2026. Their average CVSS score is 4.3, and the most serious one scores 4.3 out of 10.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (100%).

The one issue recorded for IP2Location Variables has a vendor fix available, so running the current release closes it.

All of these findings were reported by SOPROBRO. IP2Location Variables is installed on roughly 90 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium
4.3/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all IP2Location Variables vulnerabilities before they are exploited.

Highest severity on recordCVSS 4.3CVE-2025-39455

IP2Location Variables <= 2.9.5 - Cross-Site Request Forgery

Read the full analysis

Vulnerability Records

1 records
Showing 1–1 of 1 reports
IP2Location Variables banner
Latestv2.10.1

IP2Location Variables

IP2Location

Author

IP2Location

2.3(3)
46/100
Last Updated
2026-08-21 (23d ago)
Active Installs
90+
Downloads
13,190
Requires WP
2.0+
Requires PHP
0+
Tested up to
WP 7.1
Created
2013-09-13 (13y ago)

This useful library makes it easy to conveniently find website visitors location and provides geographic information based on IP address lookup. It also can be used to display geo-data info in posts for specific locations and to help you create geo-target marketing campaigns. It is a library derived from https://www.ip2location.com/developers/php but works as a WordPress plugin to simplify the setup and ease the integration work. It supports both the IPv4 and IPv6 address. Below are the geolocation information you can retrieve from this library: * Country code * Country name * Country flag * Region name * City name * Latitude and longitude * ZIP code * ISP * Domain name * Time zone * Net speed * IDD code * Area code * Weather station code & name * MNC, MCC, mobile carrier name * Elevation * Usage type * Address type * Category * District * AS Number * AS Name * AS Domain * AS Usage Type * AS CIDR This plugin supports both IP2Location IP geolocation BIN data and web service for geolocation queries. If you are using the BIN data, you can update the BIN data every month by using the wizard on the settings page for the most accurate result. Alternatively, you can also manually download and update the BIN data file using the below links: BIN file download: IP2Location Commercial database | IP2Location LITE database (free edition) If you are using the IP2Location IP geolocation web service, please visit IP2Location Web Service for details. Usage Call the function ip2location_get_vars() in any pages, plugins, or themes to retrieve IP2Location variables. The variables are returned in object. To use lookup for a custom IP, use ip2location_get_vars(&#8216;IP_ADDRESS’); More Information Please visit us at https://www.ip2location.com

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C