The vulnerability CVE-2025-22280 affects revmakx DefendWP Firewall versions up to 1.1.0. It arises from missing authorization checks within the plugin, leading to incorrect access control enforcement. This can allow an attacker with low privileges to perform actions that should require higher authorization. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, low confidentiality impact, high integrity impact, and low availability impact.

Successful exploitation could allow an attacker with limited privileges to perform unauthorized actions that compromise the integrity of the firewall configuration or operation. Confidentiality impact is low, but integrity impact is high, meaning attackers could modify or bypass firewall rules. Availability impact is low. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should restrict access to the plugin's administrative interfaces to trusted users only and monitor for unusual activity related to firewall configuration changes.