Privilege Escalation in bSecure Plugin for WordPress

CVE-2025-6187

What is CVE-2025-6187?

The bSecure plugin for WordPress is susceptible to a privilege escalation vulnerability due to inadequate authorization checks in its order_info REST endpoint. Versions 1.3.7 through 1.7.9 of the plugin have a permission callback that invariably returns true, allowing unauthenticated attackers to exploit the vulnerability. By knowing the email of any user, attackers can obtain a valid login cookie, enabling them to impersonate the user and access sensitive account information without authorization.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References