# CVE-2025-8570: BeyondCart Connector - Information Disclosure

> Live exploitation tracking for CVE-2025-8570 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-8570

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** BeyondCart Connector
- **Weaknesses:** CWE-798 (Use of Hard-coded Credentials)
- **Tags:** cms, web_application, wordpress

## Description

The BeyondCart Connector plugin for WordPress is vulnerable to Privilege Escalation due to improper JWT secret management and authorization within the determine_current_user filter in versions 1.4.2 through 2.1.0. This makes it possible for unauthenticated attackers to craft valid tokens and assume any user’s identity.

## CrowdSec analysis

[CVE-2025-8570](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-8570) is a critical privilege escalation vulnerability in the BeyondCart Connector plugin for WordPress, stemming from improper JWT secret management and authorization flaws in versions 1.4.2 through 2.1.0. This vulnerability allows unauthenticated attackers to forge valid tokens and impersonate any user, potentially leading to full site compromise and unauthorized access to sensitive data.

CrowdSec has been tracking this vulnerability and its exploits since 12th of September 2025.

CrowdSec has not observed any significant exploitation activity targeting CVE-2025-8570 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit the `/wp-json/grind-mobile-app/v1/customers/1` REST API endpoint by sending crafted PUT requests with a forged or generated JWT in the Authorization header, allowing unauthorized modification of user account details.

## Timeline

- 2025-09-11: CVE Published. CVE-2025-8570 is published to NVD.
- 2025-09-12: Rule Released. CrowdSec releases a rule to detect CVE-2025-8570 exploitation attempts against the CrowdSec Network.

## References

- https://github.com/XiaomingX/data-cve-poc/blob/main/2025/CVE-2025-8570/CVE-2025-8570.py

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-8570) follows observed exploitation activity for CVE-2025-8570. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.