Authentication Bypass Vulnerability in Browse As Plugin for WordPress
CVE-2025-5190
8.8HIGH
What is CVE-2025-5190?
The Browse As plugin for WordPress contains a vulnerability that allows authenticated users with subscriber-level permissions and higher to bypass authentication. This issue arises from improper authentication checks in the 'IS_BA_Browse_As::notice' function, specifically regarding the 'is_ba_original_user_COOKIEHASH' cookie value. As a result, an attacker could gain unauthorized access to accounts of other users, including administrators, by knowing the user ID, thus posing a significant security risk to affected WordPress sites.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
Browse As * <= 0.2
References
CVSS V3.1
Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
István Márton