CVE-2025-6187

Critical

Published: 22 July 2025

Published

22 July 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0069 71.8th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-6187 is a critical-severity Missing Authorization (CWE-862) vulnerability in Wordpress (inferred from references). Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 28.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and IA-5 (Authenticator Management).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 2 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-3 Access Enforcement good match

prevent

Mandates enforcement of approved authorizations on system resources, directly addressing the missing authorization checks in the vulnerable REST endpoint that allow unauthenticated access.

IA-5 Authenticator Management good match

prevent

Requires proper management of authenticators like login cookies to prevent their unauthorized issuance based solely on an email address without authentication.

AC-6 Least Privilege partial match

prevent

Enforces least privilege to limit the scope of damage from privilege escalation even if initial access enforcement fails.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1078 Valid Accounts Stealth

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.

attack.mitre.org →

T1550.004 Web Session Cookie Lateral Movement

Adversaries can use stolen session cookies to authenticate to web applications and services.

attack.mitre.org →

Why these techniques?

Direct unauthenticated exploitation of public WordPress REST endpoint (T1190) to obtain valid session cookies enabling account impersonation (T1078 + T1550.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

The bSecure plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within its order_info REST endpoint in versions 1.3.7 through 1.7.9. The plugin registers the /webhook/v2/order_info/ route with a permission_callback that always returns true, effectively bypassing all…

authentication. This makes it possible for unauthenticated attackers who know any user’s email to obtain a valid login cookie and fully impersonate that account.

Deeper analysisAI

CVE-2025-6187 is a privilege escalation vulnerability in the bSecure plugin for WordPress, affecting versions 1.3.7 through 1.7.9. The issue stems from missing authorization checks in the plugin's order_info REST endpoint, specifically the /webhook/v2/order_info/ route. This route is registered with a permission_callback that always returns true, bypassing all authentication requirements. The vulnerability is rated with a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-862 (Missing Authorization).

Unauthenticated attackers can exploit this vulnerability if they know any user's email address. By sending a request to the vulnerable endpoint with the target's email, attackers can obtain a valid login cookie for that user account, enabling full impersonation. This grants complete access to the victim's privileges, potentially allowing arbitrary actions such as data theft, account takeover, or further compromise of the WordPress site.

References provided include source code excerpts from the bSecure plugin's class-bsecure-checkout.php and class-wc-bsecure.php files in version 1.7.9, the plugin's WordPress.org developers page, and a Wordfence threat intelligence report on the vulnerability. Security practitioners should review these resources for code analysis and advisory details on mitigation, such as updating to a patched version if available.