CVE-2025-5190: WordPress Browse As Auth Bypass Flaw

CVE-2025-5190 Overview

CVE-2025-5190 is an authentication bypass vulnerability in the Browse As plugin for WordPress, affecting all versions up to and including 0.2. The flaw resides in the IS_BA_Browse_As::notice function, which performs incorrect validation of the is_ba_original_user_COOKIEHASH cookie value. Authenticated attackers with subscriber-level access can exploit this weakness to impersonate any user on the site, including administrators, provided they know the target user ID. The vulnerability is categorized under [CWE-288] (Authentication Bypass Using an Alternate Path or Channel).

Critical Impact
A low-privileged subscriber account can escalate to full administrator access on the WordPress site, leading to complete site takeover.

Affected Products

WordPress Browse As plugin versions 0.2 and earlier
WordPress sites with subscriber registration enabled and the plugin active
All sites using IS_BA_Browse_As::notice cookie-based session validation

Discovery Timeline

2025-05-30 - CVE-2025-5190 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-5190

Vulnerability Analysis

The Browse As plugin provides administrators with the ability to view a WordPress site through the perspective of another user account. To return to the original administrator session, the plugin stores a reference to the original user in the is_ba_original_user_COOKIEHASH cookie. The vulnerability stems from how the IS_BA_Browse_As::notice function validates this cookie before granting the session switch.

The function trusts the cookie value without verifying that the requesting user actually has authority to switch into the target account. Any authenticated session can present a forged cookie containing an arbitrary user ID. The plugin then issues a valid authenticated session for that user ID.

Exploitation requires only subscriber-level access, which many WordPress sites grant automatically upon registration. Successful exploitation yields complete account takeover and persistent administrative control.

Root Cause

The root cause is missing authorization on a privileged user-switching code path. The notice function in browse-as.php (lines 92 and 115 per the plugin source) reads the cookie and acts on its contents without confirming that the current user has previously initiated a legitimate browse-as session as an administrator.

Attack Vector

The attack is network-accessible and requires a valid low-privileged WordPress account. An attacker registers or compromises a subscriber account, sets the is_ba_original_user_COOKIEHASH cookie with the target administrator's user ID, and triggers the vulnerable handler. The plugin then authenticates the attacker as the targeted user.

No verified public proof-of-concept code is available. Refer to the WordPress Plugin Source Code and WordPress Plugin Code Review for the vulnerable logic.

Detection Methods for CVE-2025-5190

Indicators of Compromise

Unexpected presence or modification of the is_ba_original_user_COOKIEHASH cookie on requests from low-privileged accounts.
WordPress audit logs showing subscriber accounts performing administrator-level actions without an intermediate role change.
New administrator accounts, plugin installations, or theme edits originating from sessions that began as subscribers.

Detection Strategies

Inspect web server access logs for requests carrying the is_ba_original_user_COOKIEHASH cookie from sessions associated with non-administrator users.
Correlate WordPress authentication events with role-based activity to identify privilege jumps within a single session.
Use file integrity monitoring on wp-content/plugins/browse-as/ to flag the presence of vulnerable versions.

Monitoring Recommendations

Enable verbose authentication logging in WordPress and forward events to a centralized SIEM for correlation.
Alert on creation of new administrator-role users, especially from IP addresses previously tied to subscriber sessions.
Monitor outbound requests from the WordPress host for indicators of post-compromise activity such as webshell installation or credential exfiltration.

How to Mitigate CVE-2025-5190

Immediate Actions Required

Deactivate and remove the Browse As plugin from all WordPress installations until a patched version is confirmed available.
Audit all administrator and editor accounts for unauthorized additions or recent password and email changes.
Force password resets and invalidate active sessions for all privileged users on affected sites.
Review subscriber-level accounts and restrict open registration where it is not required.

Patch Information

No fixed version is identified in the published advisory at the time of writing. Versions up to and including 0.2 are vulnerable. Consult the Wordfence Vulnerability Report for updates on a vendor patch.

Workarounds

Remove the plugin entirely if the browse-as functionality is not business-critical.
Restrict WordPress registration to invitation-only and disable the default subscriber self-registration setting.
Deploy a web application firewall rule to block requests containing the is_ba_original_user_COOKIEHASH cookie from non-administrator sessions.
Apply least-privilege role assignment and remove unused low-privileged accounts.

bash

# Configuration example: disable open registration in wp-config.php
# and remove the vulnerable plugin directory
wp option update users_can_register 0
rm -rf wp-content/plugins/browse-as
wp plugin deactivate browse-as --quiet || true