CVE-2025-1502 is a missing authorization vulnerability (CWE-862) in the IP2Location Redirection WordPress plugin. Specifically, the AJAX action 'download_ip2location_redirection_backup' lacks a capability check, enabling unauthenticated attackers to download the plugin's settings. This vulnerability affects all versions up to 1.33.3. The CVSS 3.1 base score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges required, no user interaction, and limited confidentiality impact. No known exploits are reported in the wild, and no patch or remediation details have been provided by the vendor.

An unauthenticated attacker can access and download the plugin's configuration settings, potentially exposing sensitive configuration data. There is no impact on data integrity or availability. The confidentiality impact is limited to the plugin's settings, which may contain sensitive information depending on the user's configuration.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the WordPress admin AJAX endpoint if possible, and monitor for suspicious activity related to the 'download_ip2location_redirection_backup' AJAX action. Avoid exposing the plugin to untrusted users. Follow vendor updates for an official patch or temporary workaround.