CVE-2025-1502: IP2LOCATION Redirection

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

The IP2Location Redirection plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'download_ip2location_redirection_backup' AJAX action in all versions up to, and including, 1.33.3. This makes it possible for unauthenticated attackers to download the plugin's settings.

Affected products

• IP2LOCATION IP2LOCATION Redirection: up to and including 1.33.3

Published 2025-03-01. Last modified 2026-06-17.