CVE-2025-63002
Lifecycle Timeline
2Description
Missing Authorization vulnerability in wpforchurch Sermon Manager sermon-manager-for-wordpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sermon Manager: from n/a through <= 2.30.0.
Analysis
Sermon Manager for WordPress plugin through version 2.30.0 allows unauthenticated attackers to exploit missing authorization checks to access or modify sermon data due to incorrectly configured access control security levels. The vulnerability stems from CWE-862 (Missing Authorization) and affects all installations running the vulnerable version range. With an EPSS score of 0.04% (13th percentile), real-world exploitation probability is minimal despite the permission-based nature of the flaw.
Technical Context
The Sermon Manager for WordPress plugin (CPE: WP:sermon-manager-for-wordpress) fails to implement proper authorization validation on one or more endpoints or functions that interact with sermon content or administrative features. CWE-862 (Missing Authorization) indicates the application performs an action or grants access based on actor identity without verifying whether that actor is authorized to perform that specific action. This is distinct from authentication bypass-the plugin likely lacks capability checks (WordPress 'user_cap') or nonce validation on certain operations, allowing an unauthenticated or low-privileged user to access protected sermon data or functionality that should require elevated permissions. The vulnerability affects the entire 2.30.0 release line and earlier versions.
Affected Products
Sermon Manager for WordPress (WordPress plugin, affected versions from initial release through version 2.30.0 inclusive) is the sole affected product identified in this report. The plugin is cataloged at https://patchstack.com/database/Wordpress/Plugin/sermon-manager-for-wordpress/ and detailed vulnerability analysis is available via the Patchstack vulnerability reference provided.
Remediation
Update Sermon Manager for WordPress to a version newer than 2.30.0 immediately. The vendor has issued a fix documented in the Patchstack database (https://patchstack.com/database/Wordpress/Plugin/sermon-manager-for-wordpress/vulnerability/wordpress-sermon-manager-plugin-2-30-0-broken-access-control-vulnerability?_s_id=cve). WordPress administrators should navigate to the Plugins admin panel, locate Sermon Manager, and upgrade via the standard WordPress update mechanism. As an interim mitigation, restrict user role capabilities for sermon management through WordPress role editor or capability management plugins until the update is deployed, ensuring only authenticated administrative users can access sermon functions.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today