# Disabled Source, Disabled Right Click and Content Protection <= 1.8.2 - Unauthenticated PHP Object Injection via IP Geolocation Lookup

- **ID:** WPSEC-2026-1144
- **Plugin:** Disabled Source, Disabled Right Click and Content Protection (`disabled-source-disabled-right-click-and-content-protection`), https://wordpress.org/plugins/disabled-source-disabled-right-click-and-content-protection/
- **Affected versions:** all versions before 1.8.3
- **Fixed in:** 1.8.3 (Update to 1.8.3 or later.)
- **Severity:** High 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-502
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-16)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/disabled-source-disabled-right-click-and-content-protection
- **Fix released:** 2026-10-16
- **Published:** 2026-10-17
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1144/

## Description

The Disabled Source, Disabled Right Click and Content Protection plugin for WordPress is vulnerable to PHP Object Injection via the IP geolocation lookup in all versions up to, and including, 1.8.2, due to the jh_get_admin_country_code() and jh_visitor_address_checker() functions passing a response fetched over unencrypted HTTP from ip-api.com directly to unserialize(). The lookup runs on every front-end request. This makes it possible for unauthenticated attackers who can tamper with that response, such as attackers positioned on the network path between the site and the geolocation service, to inject a PHP object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

## References

- https://wpsec.com/vuln/WPSEC-2026-1144/
- https://plugins.svn.wordpress.org/disabled-source-disabled-right-click-and-content-protection/tags/1.8.3/
- https://wordpress.org/plugins/disabled-source-disabled-right-click-and-content-protection/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1144/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.