CVE-2025-8570 is a critical vulnerability in the BeyondCart Connector WordPress plugin caused by the use of hard-coded credentials (CWE-798) for JWT secret management. This improper handling within the determine_current_user filter enables unauthenticated attackers to generate valid tokens and assume any user identity, resulting in full privilege escalation. The affected versions include 1.4.2 through 3.0.1. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. There is no vendor-provided patch or advisory linked, and the plugin is not a cloud service.

Successful exploitation allows unauthenticated attackers to impersonate any user, including administrators, leading to complete compromise of the affected WordPress site. This includes full control over site content, configuration, and potentially sensitive data. The vulnerability impacts confidentiality, integrity, and availability at a critical level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to disable or remove the BeyondCart Connector plugin if possible. Monitor vendor channels for updates and apply patches promptly once released. Avoid exposing the affected plugin to untrusted networks or users.