CVE-2025-6187P2CRITICALCVSS 9.8≥ 1.3.7, ≤ 1.7.92025-07-22
CVE-2025-6187 [CRITICAL] CWE-862 CVE-2025-6187: The bSecure plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization
The bSecure plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within its order_info REST endpoint in versions 1.3.7 through 1.7.9. The plugin registers the /webhook/v2/order_info/ route with a permission_callback that always returns true, effectively bypassing all authentication. This makes it possible for unauth
nvd