CVE-2025-6187 CRITICAL

CVE-2025-6187: bSecure 1.3.7 - 1.7.9 - Missing Authorization to Unauthenticated Privilege Escalation via order_info REST Endpoint

Vendor Bsecuretech
Product bSecure – Your Universal Checkout
Weakness CWE-862 · Missing authorization
Published July 22, 2025
Last update July 22, 2025
View on NVD All CVEs

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

The bSecure plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within its order_info REST endpoint in versions 1.3.7 through 1.7.9. The plugin registers the /webhook/v2/order_info/ route with a permission_callback that always returns true, effectively bypassing all authentication. This makes it possible for unauthenticated attackers who know any user’s email to obtain a valid login cookie and fully impersonate that account.

Explanation of Vulnerability in Simple Terms

02Summary

bSecure – Your Universal Checkout versions 1.3.7 through 1.7.9 lack proper authorization checks, allowing unauthenticated attackers to access sensitive functionality over the network. An attacker can read, modify, or delete data without needing valid credentials or user interaction. This affects any site running the vulnerable plugin.

What an attacker can do

03Attacker Capabilities

Read, modify, or delete sensitive data without authentication.

Potential impact on your site

04Site Impact

Attackers can access customer data, payment information, and site configuration without logging in.

Conditions required to exploit

05Prerequisites

Network access only; no authentication or user interaction required.

Key dates

06Disclosure timeline

July 22, 2025 CVE published
July 22, 2025 Record updated