Unauthorized Data Access in IP2Location Redirection Plugin for WordPress

CVE-2025-1502

What is CVE-2025-1502?

The IP2Location Redirection plugin for WordPress is susceptible to unauthorized data access due to a vulnerability stemming from a missing capability check on the 'download_ip2location_redirection_backup' AJAX action. This issue affects all versions of the plugin up to and including 1.33.3, allowing unauthenticated attackers the potential to download sensitive settings from the plugin. This oversight poses a significant risk to user data and highlights the need for prompt updates to secure the affected plugin.

References