CVE-2025-1481 describes a missing authorization vulnerability in the Shortcode Cleaner Lite WordPress plugin (versions up to 1.0.9). The download_backup() function lacks capability checks, enabling authenticated users with minimal privileges (Subscriber-level and above) to export arbitrary plugin options. This unauthorized data access vulnerability is categorized under CWE-862 and has a CVSS 3.1 base score of 6.5, reflecting a medium severity impact primarily on confidentiality.

An attacker with Subscriber-level access or higher can export arbitrary options from the plugin without proper authorization. This leads to unauthorized disclosure of potentially sensitive configuration data. The vulnerability does not affect integrity or availability according to the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict plugin access to trusted users only and consider removing or disabling the plugin if possible to prevent unauthorized data export.