bSecure 1.3.7 – 1.7.9 – Missing Authorization to Unauthenticated Privilege Escalation via order_info REST Endpoint

Basic Information

Title	bSecure 1.3.7 – 1.7.9 – Missing Authorization to Unauthenticated Privilege Escalation via order_info REST Endpoint
Type	cve
Published	2025-07-22T09:22:44.548Z
Modified	2025-07-22T09:22:44.548Z

Product Information

Vendor	bsecuretech
Product	bSecure – Your Universal Checkout
Version	1.3.7

The bSecure plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within its order_info REST endpoint in versions 1.3.7 through 1.7.9. The plugin registers the /webhook/v2/order_info/ route with a permission_callback that always returns true, effectively bypassing all authentication. This makes it possible for unauthenticated attackers who know any user’s email to obtain a valid login cookie and fully impersonate that account.