Critical · published July 22, 2025
🚨 One sneaky misconfiguration lets attackers tap into your user accounts without breaking a sweat! 🌪️ The bSecure plugin for WordPress has a critical privilege escalation vulnerability that puts your site's security at serious risk. Think of it as a restaurant where the staff never check IDs at the door. Anyone with a reservation can walk in and impersonate a regular, ordering anything they want — that’s how easily attackers can swipe someone else's session here. This vulnerability could lead to absolute chaos! An attacker could impersonate any user by simply knowing their email, gaining full access to sensitive data and actions tied to that account. They could change passwords, make purchases, or even delete content — a real recipe for disaster!
Think of it as a restaurant where the staff never check IDs at the door. Anyone with a reservation can walk in and impersonate a regular, ordering anything they want — that’s how easily attackers can swipe someone else's session here. The bSecure plugin's /webhook/v2/order_info/ endpoint lacks proper authorization checks; it always returns true, meaning anyone can access it without authentication. This allows attackers to obtain valid login cookies and impersonate users effortlessly.
This vulnerability could lead to absolute chaos! An attacker could impersonate any user by simply knowing their email, gaining full access to sensitive data and actions tied to that account. They could change passwords, make purchases, or even delete content — a real recipe for disaster! Immediate action is required! Update the bSecure plugin to version 1.7.10 or later to patch this vulnerability, and review your REST endpoint configurations to ensure proper authorization checks are in place. Regular security audits are also recommended! You’ve got this! With these steps, you can secure your WordPress site and protect your users from potential threats. 🛡️