CVE-2025-22280

High

Published: 27 February 2025

Published

27 February 2025

Modified

23 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

EPSS Score 0.0012 31.1th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-22280 is a high-severity Missing Authorization (CWE-862) vulnerability. Its CVSS base score is 7.6 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 31.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-22280 is a missing authorization vulnerability, classified under CWE-862 (Missing Authorization), in the DefendWP Firewall WordPress plugin (defend-wp-firewall) developed by revmakx. The flaw allows exploitation of incorrectly configured access control security levels and affects all versions of the plugin from n/a through 1.1.0. It was published on 2025-02-27.

The vulnerability carries a CVSS v3.1 base score of 7.6 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L), indicating it can be exploited over the network with low attack complexity by users with low privileges, requiring no user interaction and maintaining unchanged scope. Attackers can achieve low confidentiality impact, high integrity impact, and low availability impact through unauthorized access enabled by the missing authorization checks.

Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/defend-wp-firewall/vulnerability/wordpress-defendwp-firewall-plugin-1-1-0-broken-access-control-vulnerability?_s_id=cve.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-5471

Vulnerability details

Missing Authorization vulnerability in revmakx DefendWP Firewall defend-wp-firewall allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DefendWP Firewall: from n/a through <= 1.1.0.

CWE(s): CWE-862

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

Why these techniques?

Missing authorization (CWE-862) in public-facing WordPress plugin allows network exploitation by low-privilege users with high integrity impact, directly enabling T1190 (Exploit Public-Facing Application) for initial access and T1068 (Exploitation for Privilege Escalation) to achieve unauthorized actions.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1