PT-2025-37134 · WordPress · Beyondcart Connector

Kenneth Dunn · Published 2025-09-11 · Updated 2025-09-16 · CVE-2025-8570

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BeyondCart Connector plugin for WordPress versions 1.4.2 through 2.1.0

Description The BeyondCart Connector plugin for WordPress is susceptible to privilege escalation due to improper JWT (JSON Web Token) secret management and authorization within the determine current user filter. This allows unauthenticated attackers to create valid tokens and impersonate any user.

Recommendations Update BeyondCart Connector plugin to a version later than 2.1.0.

Fix

LPE

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2025-8570

Affected Products

Beyondcart Connector

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-8570 · Security Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3365845%40beyondcart&new=3365845%40beyondcart&sfp_email=&sfph_mail= · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/d0dd4fc0-1c6a-4556-b219-893563a27a69?source=cve · Note
• https://wordpress.org/plugins/beyondcart/#developers · Note
• https://twitter.com/cracbot/status/1967906350203109449 · Twitter Post