Privilege Escalation Vulnerability in BeyondCart Connector for WordPress
CVE-2025-8570

9.8CRITICAL

Key Information:

Vendor

WordPress
Status
Beyondcart Connector
Vendor
CVE Published:
11 September 2025

What is CVE-2025-8570?

The BeyondCart Connector plugin for WordPress contains a vulnerability that allows unauthenticated users to exploit improper management of JSON Web Tokens (JWT). Specifically, the flaw lies in the inadequate authorization handling within the determine_current_user filter, present in versions 1.4.2 to 2.1.0. This vulnerability enables attackers to craft valid tokens, potentially impersonating any user, thereby affecting the security and integrity of user accounts on affected WordPress sites.

Affected Version(s)

BeyondCart Connector * <= 2.1.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://wordpress.org/plugins/beyondcart/#developers

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kenneth Dunn
.
CVE-2025-8570 : Privilege Escalation Vulnerability in BeyondCart Connector for WordPress