Authentication Bypass Vulnerability in Browse As Plugin for WordPress

CVE-2025-5190

What is CVE-2025-5190?

The Browse As plugin for WordPress contains a vulnerability that allows authenticated users with subscriber-level permissions and higher to bypass authentication. This issue arises from improper authentication checks in the 'IS_BA_Browse_As::notice' function, specifically regarding the 'is_ba_original_user_COOKIEHASH' cookie value. As a result, an attacker could gain unauthorized access to accounts of other users, including administrators, by knowing the user ID, thus posing a significant security risk to affected WordPress sites.

References