CVE-2025-63022: 
WordPress vulnerability analysis and mitigation

CVE-2025-63022 is a Missing Authorization (Broken Access Control) vulnerability in the "Simple Like Page" WordPress plugin (plugin slug: simple-facebook-plugin) developed by topdevs.net. It affects all versions from n/a through 1.5.3 and allows unauthenticated remote attackers to exploit incorrectly configured access control security levels. The CVE was published on December 31, 2025, and assigned by Patchstack. It carries a CVSS v3.1 base score of 5.3 (Medium) (Patchstack, Red Hat CVE).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before executing certain actions. This allows network-based attackers with no authentication or privileges required to interact with restricted plugin functionality. The attack complexity is low and requires no user interaction, making it straightforward to exploit over the network. No detailed technical write-up or proof-of-concept code has been publicly disclosed beyond the Patchstack advisory (Patchstack, Red Hat CVE).

Successful exploitation results in a low-integrity impact with no confidentiality or availability impact, meaning an unauthenticated attacker can make unauthorized modifications to data or plugin state managed by the Simple Like Page plugin. The scope is unchanged, limiting the impact to the affected WordPress plugin's functionality rather than the broader system. While the impact is relatively contained, unauthorized data modification on a WordPress site could affect page content or plugin settings visible to end users (Red Hat CVE, Patchstack).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-63022. The EPSS score is approximately 0.028% (0.000280), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Red Hat CVE).

Users of the Simple Like Page WordPress plugin (simple-facebook-plugin) should update to a version beyond 1.5.3 if a patched release becomes available. As of the advisory, the plugin was tagged as "unsupported-when-assigned" (later removed), suggesting the plugin may have been unmaintained at the time of disclosure; site administrators should consider deactivating and removing the plugin if no patch is released. Restricting access to WordPress admin and plugin endpoints via web application firewall (WAF) rules can serve as a compensating control (Patchstack, Red Hat CVE).