PT-2025-23281 · WordPress · Browse As

István Márton · Published 2025-05-30 · Updated 2025-06-04 · CVE-2025-5190

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Browse As plugin for WordPress versions up to, and including, 0.2

Description The issue is due to incorrect authentication checking in the IS BA Browse As::notice function with the is ba original user COOKIEHASH cookie value. This allows authenticated attackers with subscriber-level permissions and above to log in as any existing user on the site, such as an administrator, if they have access to the user id.

Recommendations For versions up to, and including, 0.2, consider disabling the IS BA Browse As::notice function until a patch is available to prevent exploitation. Restrict access to sensitive user information, such as user id, to minimize the risk of unauthorized access.

Fix

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2025-5190

Affected Products

Browse As

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-5190 · Security Note
• https://twitter.com/cracbot/status/1930218038583812231 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/8f5722b0-0d54-4c44-b168-a886da1077cb?source=cve · Note
• https://t.me/cvenotify/124130 · Telegram Post
• https://t.me/cvetracker/25003 · Telegram Post
• https://twitter.com/offseq/status/1928428715312123981 · Twitter Post
• https://plugins.trac.wordpress.org/browser/browse-as/tags/0.2/browse-as.php#L115 · Note
• https://plugins.trac.wordpress.org/browser/browse-as/tags/0.2/browse-as.php#L92 · Note
• https://twitter.com/VulmonFeeds/status/1928433805695529453 · Twitter Post
• https://twitter.com/CVEnew/status/1928413166100210046 · Twitter Post