CVE-2025-6187 — AI Deep Analysis Summary

🚨 **Essence**: The `order_info` REST endpoint in bSecure lacks proper authorization checks.…

🛡️ **Root Cause**: **CWE-862** (Missing Authorization). The flaw lies in the `class-bsecure-checkout.php` file where the REST API endpoint does not verify if the user has the right permissions to access the data. 🔍

📦 **Affected**: WordPress Plugin **bSecure – Your Universal Checkout**. 📅 **Version**: **1.7.9 and earlier**. 🏢 **Vendor**: bsecuretech. If you are running an older version, you are at risk!

💀 **Attacker Capabilities**: With **CVSS 9.8 (Critical)**, attackers can achieve: 🔓 **High Confidentiality** breach (read sensitive data), 🔓 **High Integrity** breach (modify data), and 🔓 **High Availability** impact.…

⚡ **Exploitation Threshold**: **LOW**. 🌐 **Network**: Remote (AV:N). 🔑 **Privileges**: None required (PR:N). 🖱️ **User Interaction**: None (UI:N). 🎯 **Complexity**: Low (AC:L).…

🚫 **Public Exploit**: **No**. The `pocs` field is empty in the provided data. While references exist (WordFence, WordPress Trac), there is no confirmed public Proof-of-Concept (PoC) or widespread wild exploitation yet.…

🔍 **Self-Check**: Scan your WordPress site for the **bSecure** plugin. 📋 Check the version number. If it is **≤ 1.7.9**, you are vulnerable.…

✅ **Official Fix**: **Yes**. The vendor (bsecuretech) has acknowledged the issue. 🔄 **Action**: Update the plugin to the latest version immediately.…

🛑 **No Patch? Workaround**: If you cannot update immediately: 🚫 **Disable** the plugin if not critical. 🛡️ **Restrict** access to the `/wp-json/` endpoint via WAF (Web Application Firewall).…

🔥 **Urgency**: **CRITICAL**. With a **CVSS 9.8** score and **no auth required**, this is a high-priority vulnerability. 🏃 **Action**: Patch **IMMEDIATELY**.…