What is the CVSS score of CVE-2025-63002?

CVE-2025-63002 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2025-63002

MEDIUM

Missing Authorization (CWE-862)

2025-12-18 audit@patchstack.com

WordPress Authentication Bypass

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:43 NVD

5.3 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 17:44 vuln.today

CVE Published

Dec 18, 2025 - 17:15 nvd

N/A

DescriptionCVE.org

Missing Authorization vulnerability in wpforchurch Sermon Manager sermon-manager-for-wordpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sermon Manager: from n/a through <= 2.30.0.

AnalysisAI

Sermon Manager for WordPress plugin through version 2.30.0 allows unauthenticated attackers to exploit missing authorization checks to access or modify sermon data due to incorrectly configured access control security levels. The vulnerability stems from CWE-862 (Missing Authorization) and affects all installations running the vulnerable version range. With an EPSS score of 0.04% (13th percentile), real-world exploitation probability is minimal despite the permission-based nature of the flaw.

Technical ContextAI

The Sermon Manager for WordPress plugin (CPE: WP:sermon-manager-for-wordpress) fails to implement proper authorization validation on one or more endpoints or functions that interact with sermon content or administrative features. CWE-862 (Missing Authorization) indicates the application performs an action or grants access based on actor identity without verifying whether that actor is authorized to perform that specific action. This is distinct from authentication bypass-the plugin likely lacks capability checks (WordPress 'user_cap') or nonce validation on certain operations, allowing an unauthenticated or low-privileged user to access protected sermon data or functionality that should require elevated permissions. The vulnerability affects the entire 2.30.0 release line and earlier versions.

Affected ProductsAI

Sermon Manager for WordPress (WordPress plugin, affected versions from initial release through version 2.30.0 inclusive) is the sole affected product identified in this report. The plugin is cataloged at https://patchstack.com/database/Wordpress/Plugin/sermon-manager-for-wordpress/ and detailed vulnerability analysis is available via the Patchstack vulnerability reference provided.

RemediationAI

Update Sermon Manager for WordPress to a version newer than 2.30.0 immediately. The vendor has issued a fix documented in the Patchstack database (https://patchstack.com/database/Wordpress/Plugin/sermon-manager-for-wordpress/vulnerability/wordpress-sermon-manager-plugin-2-30-0-broken-access-control-vulnerability?_s_id=cve). WordPress administrators should navigate to the Plugins admin panel, locate Sermon Manager, and upgrade via the standard WordPress update mechanism. As an interim mitigation, restrict user role capabilities for sermon management through WordPress role editor or capability management plugins until the update is deployed, ensuring only authenticated administrative users can access sermon functions.