CVE-2025-6187: The bSecure plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within its order_info REST endpoint in versions 1.3.7…

PriorityP270critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

0.67%

47.2th percentile

The bSecure plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within its order_info REST endpoint in versions 1.3.7 through 1.7.9. The plugin registers the /webhook/v2/order_info/ route with a permission_callback that always returns true, effectively bypassing all authentication. This makes it possible for unauthenticated attackers who know any user’s email to obtain a valid login cookie and fully impersonate that account.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
bsecuretech	bsecure_your_universal_checkout	1.3.7 – 1.7.9	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.