Introduction
A critical flaw in JWT authentication lets attackers take administrative control of WordPress e-commerce sites running BeyondCart Connector. It puts customer data and site integrity at risk, along with the trustworthiness of mobile commerce integrations.
About BeyondCart and the BeyondCart Connector: BeyondCart is a SaaS platform that lets WordPress and WooCommerce sites offer native mobile shopping apps. Its BeyondCart Connector plugin synchronizes e-commerce data between WordPress sites and those apps. The plugin is widely used, serving thousands of small to medium-sized retailers pursuing mobile-first strategies. Stores rely on it for real-time order processing and customer engagement, so its security is vital to the online businesses that run it.
Technical Information
CVE-2025-8570 is a privilege escalation vulnerability in the BeyondCart Connector plugin for WordPress. It comes from improper management of JWT (JSON Web Token) secrets and insufficient authorization logic in the plugin's use of the determine_current_user filter. That filter is a WordPress hook that lets plugins override the default way WordPress identifies the user during authentication.
The plugin uses hard-coded or predictable JWT secrets, which violates cryptographic best practice. An attacker can study the plugin code or a deployment to find the static secret, or simply predict it. With the secret in hand, the attacker can craft JWT tokens carrying any claims they want, including administrator privileges. The plugin accepts these forged tokens as valid, so an unauthenticated user can impersonate any account, administrators included.
The vulnerability is classified as CWE-798 (Use of Hard-coded Credentials) and affects BeyondCart Connector versions 1.4.2 through 2.1.0. No public code snippets or proof of concept are available at this time.
Affected Systems and Versions
- BeyondCart Connector plugin for WordPress
- Affected versions: 1.4.2 through 2.1.0
- All configurations using the plugin in this version range are vulnerable
Vendor Security History
Wordfence has previously reported JWT implementation issues in the BeyondCart Connector plugin. That history suggests recurring problems with the vendor's authentication design and secure coding practices. The vendor's patch response time and overall security maturity are a concern, especially given how critical this vulnerability and the earlier ones are.
