CVE-2025-22280
Published: 27 February 2025
Description
Missing Authorization vulnerability in revmakx DefendWP Firewall defend-wp-firewall allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DefendWP Firewall: from n/a through <= 1.1.0.
Security Summary
CVE-2025-22280 is a missing authorization vulnerability, classified under CWE-862 (Missing Authorization), in the DefendWP Firewall WordPress plugin (defend-wp-firewall) developed by revmakx. The flaw allows exploitation of incorrectly configured access control security levels and affects all versions of the plugin from n/a through 1.1.0. It was published on 2025-02-27.
The vulnerability carries a CVSS v3.1 base score of 7.6 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L), indicating it can be exploited over the network with low attack complexity by users with low privileges, requiring no user interaction and maintaining unchanged scope. Attackers can achieve low confidentiality impact, high integrity impact, and low availability impact through unauthorized access enabled by the missing authorization checks.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/defend-wp-firewall/vulnerability/wordpress-defendwp-firewall-plugin-1-1-0-broken-access-control-vulnerability?_s_id=cve.
Details
- CWE(s)