CVE-2025-8570
CRITICALBeyondCart Connector <2.1.0 - Privilege Escalation
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2025-8570. PoCs published by Boshe99, Nxploited.
AI-analyzed exploit summary The repository contains functional exploit code for CVE-2025-8570, targeting a WordPress plugin (3DPrint Lite 1.9.1.4) with an arbitrary file upload vulnerability. The Python script demonstrates the vulnerability by uploading a file to a vulnerable endpoint.
Description
The BeyondCart Connector plugin for WordPress is vulnerable to Privilege Escalation due to improper JWT secret management and authorization within the determine_current_user filter in versions 1.4.2 through 3.0.1. This makes it possible for unauthenticated attackers to craft valid tokens and assume any user’s identity.
Exploits (2)
The repository contains functional exploit code for CVE-2025-8570, targeting a WordPress plugin (3DPrint Lite 1.9.1.4) with an arbitrary file upload vulnerability. The Python script demonstrates the vulnerability by uploading a file to a vulnerable endpoint.
The repository contains a functional Python exploit for CVE-2025-8570, which targets a JWT secret misconfiguration in the BeyondCart Connector WordPress plugin, allowing unauthenticated privilege escalation to administrator.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H