The vulnerability stems from improper handling of the JWT secret and the absence of authorization checks in the determine_current_user filter within BeyondCart Connector versions 1.4.2 through 3.0.1. An unauthenticated attacker can forge a valid JSON Web Token and impersonate any existing user on a WordPress site, gaining full access to that user’s privileges. This allows the attacker to read, modify, or delete data, and to perform administrative actions without authenticating, matching CWE‑798.

BeyondCart Connector for WordPress, versions 1.4.2 to 3.0.1 are affected. The issue exists in the plugin distributed through the WordPress plugin repository under the vendor beyondcart.

The CVSS score of 9.8 indicates critical severity, while the EPSS score of less than 1% suggests a very low exploitation probability at this time. The vulnerability is not listed in CISA’s KEV catalog. Given that the flaw requires an unauthenticated attacker to craft a valid token, the likely attack vector involves sending a forged JWT in HTTP requests to endpoints that invoke the determine_current_user filter. No additional prerequisites beyond accessing the WordPress site are required.