CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The BeyondCart Connector plugin for WordPress is vulnerable to Privilege Escalation due to improper JWT secret management and authorization within the determine_current_user filter in versions 1.4.2 through 3.0.1. This makes it possible for unauthenticated attackers to craft valid tokens and assume any user’s identity.
Explanation of Vulnerability in Simple Terms
BeyondCart Connector versions 3.0.1 and earlier contain hardcoded credentials or similar authentication bypass vulnerability. An attacker on the network can gain full control of the connector without authentication, reading sensitive data, modifying settings, or disrupting service. No user interaction or special privileges are required.
What an attacker can do
Read sensitive data, modify connector settings, or disrupt service without any authentication.
Potential impact on your site
Attackers can access and modify your BeyondCart integration, potentially exposing customer data or disrupting e-commerce operations.
Conditions required to exploit
Network access to the BeyondCart Connector; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
