CVE-2025-63002: 
WordPress vulnerability analysis and mitigation

CVE-2025-63002 is a Missing Authorization (Broken Access Control) vulnerability in the wpforchurch Sermon Manager WordPress plugin. It affects all versions through 2.30.0 and allows unauthenticated network attackers to exploit incorrectly configured access control security levels, resulting in unauthorized read access to sensitive application data. The vulnerability was reported by researcher Legion Hunter on October 29, 2025, and published by Patchstack on November 28, 2025, with the CVE assigned on December 18, 2025. It carries a CVSS v3.1 base score of 5.3 (Medium) (Patchstack, Red Hat CVE).

The root cause is classified as CWE-862 (Missing Authorization), where one or more plugin functions fail to perform adequate authorization checks before executing privileged or sensitive operations. This allows unauthenticated remote attackers to invoke these functions over the network without any credentials or special privileges, exploiting misconfigured access control levels. The attack vector is network-based, requires no user interaction, and has low attack complexity, making it straightforward to exploit. No public proof-of-concept code has been identified at this time (Patchstack).

Successful exploitation results in a limited confidentiality breach, allowing unauthenticated attackers to read sensitive application data that should be restricted to authorized users. There is no impact on integrity or availability based on the CVSS assessment. The scope is limited to the affected WordPress installation, with no evidence of lateral movement potential or significant data exfiltration risk beyond the plugin's data context (Patchstack, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-63002. The EPSS score is approximately 0.028%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority, noting it is unlikely to be exploited despite the potential for mass-exploit campaigns targeting WordPress plugins generally (Patchstack).

As of the time of disclosure, no official patch has been released by the plugin developer (wpforchurch) for the Sermon Manager plugin. Patchstack recommends updating the affected plugin as the immediate action; if an update is unavailable, site owners should consult their hosting provider or web developer. As a workaround, administrators may consider deactivating the plugin until a patched version is available, or using a web application firewall (WAF) solution such as Patchstack to virtually patch the vulnerability. Monitor the plugin's WordPress repository for updates beyond version 2.30.0 (Patchstack).

The vulnerability was covered in Wordfence's weekly WordPress vulnerability report and noted across several security aggregation platforms including Vulners, CIRCL, and CVEFeed. Community reaction has been minimal given the low severity and limited exploitation potential. No notable researcher commentary or significant media coverage beyond standard vulnerability database entries has been identified (Wordfence).