CVE-2025-1502 — IP2Location Redirection <= 1.33.3 - Missing Authorization to Unauthenticated Settings Export

Back Back to CVE browser

MEDIUM

IP2Location Redirection <= 1.33.3 - Missing Authorization to Unauthenticated Settings Export

Published Mar 1, 2025

5.3

MEDIUM

CVSS 3.1

EPSS 0.30%

Description

The IP2Location Redirection plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'download_ip2location_redirection_backup' AJAX action in all versions up to, and including, 1.33.3. This makes it possible for unauthenticated attackers to download the plugin's settings.

Affected products

Vendor Ip2location Product IP2Location Redirection Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <=1.33.3

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Ip2location

IP2Location Redirection

unaffected

Version	Status	Constraints
0	affected	<=1.33.3

Remediation

No remediation recorded yet.

Metrics

0.30% 0.00298

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 3, 2026.

EPSS probability 0.00298

Score over time

2025–2026

EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v3
EPSS v4
EPSS v5

Table of values (4 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 3, 2026	0.30% (0.00298)	20.39th	v5 (v2026.06.15)
Jun 15, 2026	0.27% (0.00275)	19.00th	v5 (v2026.06.15)
Mar 17, 2025	0.05% (0.00050)	12.57th	v4 (v2025.03.14)
Mar 2, 2025	0.05% (0.00046)	19.75th	v3 (v2023.03.01)

Weaknesses (1)

CWE-862

Missing Authorization

References (2)

Link	Providers	Tags
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3244195%40ip2location-redirection&new=3244195%40ip2location-redirection&sfp_email=&sfph_mail=
https://www.wordfence.com/threat-intel/vulnerabilities/id/bca41dd8-5bd3-4fee-9f3f-feb8f1a4c687?source=cve