Privilege Escalation in bSecure Plugin for WordPress

CVE-2025-6187

What is CVE-2025-6187?

The bSecure plugin for WordPress is susceptible to a privilege escalation vulnerability due to inadequate authorization checks in its order_info REST endpoint. Versions 1.3.7 through 1.7.9 of the plugin have a permission callback that invariably returns true, allowing unauthenticated attackers to exploit the vulnerability. By knowing the email of any user, attackers can obtain a valid login cookie, enabling them to impersonate the user and access sensitive account information without authorization.

References