What is the CVSS score of CVE-2025-63022?

CVE-2025-63022 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Wordpress Plugin CVE-2025-63022

MEDIUM

Missing Authorization (CWE-862)

2025-12-31 audit@patchstack.com

WordPress Authentication Bypass Wordpress Plugin

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:43 NVD

5.3 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 17:44 vuln.today

CVE Published

Dec 31, 2025 - 15:15 nvd

N/A

DescriptionCVE.org

Missing Authorization vulnerability in topdevs.net Simple Like Page simple-facebook-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Like Page: from n/a through <= 1.5.3.

AnalysisAI

Simple Like Page WordPress plugin versions 1.5.3 and earlier allows unauthenticated attackers to bypass access controls and perform unauthorized actions through incorrectly configured authentication checks, enabling exploitation of missing authorization enforcement in plugin functionality. The vulnerability affects the widely-deployed Simple Like Page plugin and has low estimated exploitation probability (EPSS 0.04%) but represents a classic access control weakness that could permit unauthorized modification of plugin data or settings.

Technical ContextAI

Simple Like Page is a WordPress plugin that manages social engagement features. The vulnerability stems from CWE-862 (Missing Authorization), which occurs when the plugin fails to implement proper permission checks before performing sensitive operations. The plugin likely exposes administrative or user-modifying functionality via WordPress REST API endpoints, AJAX handlers, or direct form submissions without verifying that the requesting user has the necessary capabilities (admin, moderator, or appropriate role). This is a common WordPress security issue where developers implement authentication (verifying who you are) but omit authorization (verifying what you're allowed to do). The affected product is identified via CPE mapping to the WordPress Simple Like Page plugin through version 1.5.3.

Affected ProductsAI

Simple Like Page WordPress plugin versions through 1.5.3 are affected, as confirmed by the vulnerability reference in the Patchstack WordPress plugin database. The plugin is hosted on the WordPress.org plugin repository and likely deployed across thousands of WordPress installations. Exact version ranges with CPE mapping are available via the Patchstack vulnerability database entry referenced in the advisory.

RemediationAI

Update Simple Like Page plugin to version 1.5.4 or later, which addresses the missing authorization vulnerability by implementing proper access control checks. Users should navigate to their WordPress dashboard, select Plugins > Installed Plugins, locate Simple Like Page, and click Update if available. If a patched version is not yet available in the WordPress plugin repository, temporarily deactivate the plugin to prevent exploitation. For additional technical details and advisory information, consult the Patchstack vulnerability database entry at https://patchstack.com/database/Wordpress/Plugin/simple-facebook-plugin/vulnerability/wordpress-simple-like-page-plugin-1-5-3-broken-access-control-vulnerability.