CVE-2025-6187: bSecure 1.3.7 - 1.7.9 - Missing Authorization to Unauthenticated Privilege Escalation via order_info REST Endpoint
The bSecure plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within its orderinfo REST endpoint in versions 1.3.7 through 1.7.9. The plugin registers the /webhook/v2/orderinfo/ route with a permissioncallback that always returns true, effectively bypassing all authentication. This makes it possible for unauthenticated attackers who know any user’s email to obtain a valid login cookie and fully impersonate that account.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the bSecure plugin so the /webhook/v2/order_info/ REST route no longer uses a permission_callback that always returns true; require proper authorization for the endpoint instead of bypassing authentication.
bSecure plugin for WordPress (order_info REST endpoint) permission_callback for /webhook/v2/order_info/ = should not always return true
Event History
Frequently Asked Questions
What is the severity of CVE-2025-6187?
CVE-2025-6187 is considered a high severity vulnerability due to its potential for privilege escalation.
How do I fix CVE-2025-6187?
To mitigate CVE-2025-6187, update the bSecure plugin for WordPress to version 1.8.0 or later.
What impact does CVE-2025-6187 have on my site?
CVE-2025-6187 allows unauthorized users to access sensitive order information, potentially compromising user data.
Which versions of the bSecure plugin are affected by CVE-2025-6187?
CVE-2025-6187 affects bSecure plugin versions between 1.3.7 and 1.7.9.
Is CVE-2025-6187 specific to WordPress?
Yes, CVE-2025-6187 is a vulnerability within the bSecure plugin that operates on the WordPress platform.