The vulnerability CVE-2025-63002 in the wpforchurch Sermon Manager plugin for WordPress involves missing authorization checks due to incorrectly configured access control security levels. This allows an attacker without privileges to access or interact with parts of the plugin that should be restricted. The affected versions include all versions up to 2.30.0. The CVSS 3.1 base score is 5.3, reflecting a network attack vector with low complexity and no privileges or user interaction required, impacting confidentiality but not integrity or availability.

An attacker can exploit the missing authorization to gain unauthorized access to certain data or functionalities within the Sermon Manager plugin. The impact is limited to confidentiality loss, with no direct impact on integrity or availability. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting access to the Sermon Manager plugin features and monitor for updates from wpforchurch. Applying principle of least privilege to user roles interacting with the plugin may reduce risk.