CVE-2025-58979: BerqWP Authorization Bypass Vulnerability

CVE-2025-58979 Overview

CVE-2025-58979 is a Missing Authorization vulnerability [CWE-862] affecting the BerqWP searchpro plugin for WordPress. The flaw stems from incorrectly configured access control security levels, permitting unauthenticated network-based requests to reach functionality that should require authorization. The issue affects BerqWP versions from an unspecified initial release through 2.2.53. Attackers can exploit this weakness remotely over the network without user interaction or prior authentication.

Critical Impact
Unauthenticated attackers can access plugin functionality intended to be protected by access controls, resulting in limited integrity impact on affected WordPress sites running BerqWP searchpro version 2.2.53 or earlier.

Affected Products

BerqWP searchpro plugin for WordPress
All versions up to and including 2.2.53
WordPress installations with the BerqWP plugin activated

Discovery Timeline

2025-09-09 - CVE CVE-2025-58979 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58979

Vulnerability Analysis

The vulnerability is a Broken Access Control weakness in the BerqWP searchpro WordPress plugin. The plugin exposes actions or endpoints that fail to verify whether the requesting user has the required capability or role before executing sensitive operations. According to the CVSS vector, the attack is executed over the network with low complexity and requires no privileges or user interaction. The impact is limited to integrity — attackers can modify or trigger state changes but cannot directly read confidential data or cause service disruption through this flaw alone.

An EPSS score of 0.203% indicates a low probability of exploitation in the near term, and no public proof-of-concept or in-the-wild exploitation has been reported. However, WordPress plugins with missing authorization checks are commonly targeted in automated scanning campaigns against exposed sites.

Root Cause

The root cause is a missing authorization check [CWE-862]. The plugin defines callable handlers — likely AJAX actions, REST endpoints, or admin-post hooks — without invoking WordPress capability checks such as current_user_can() or nonce verification via check_ajax_referer(). This absence of server-side authorization allows any HTTP client to invoke the affected functions.

Attack Vector

An unauthenticated remote attacker sends crafted HTTP requests to the exposed plugin endpoint on a vulnerable WordPress site. Because no capability check gates execution, the plugin performs the privileged action on behalf of the anonymous requester. The vulnerability mechanism is described in the Patchstack Vulnerability Database Entry. No verified exploit code is publicly available at this time.

Detection Methods for CVE-2025-58979

Indicators of Compromise

Unauthenticated POST or GET requests to BerqWP searchpro plugin endpoints under /wp-admin/admin-ajax.php or /wp-json/ routes registered by the plugin.
Unexpected changes to plugin configuration, cache state, or search index data on WordPress sites running BerqWP <= 2.2.53.
Spikes in anonymous requests referencing BerqWP action names in query strings or POST bodies.

Detection Strategies

Inventory WordPress installations to identify the BerqWP searchpro plugin and verify its version against 2.2.53.
Review web server access logs for repeated unauthenticated requests targeting BerqWP endpoints from single-source IPs.
Deploy a web application firewall (WAF) rule that flags requests to BerqWP handlers lacking valid authentication cookies or nonces.

Monitoring Recommendations

Enable WordPress audit logging to capture plugin option changes, user role modifications, and administrative actions.
Monitor outbound requests from the WordPress host that could indicate follow-on compromise chained with this vulnerability.
Alert on any modification to files within the BerqWP plugin directory outside of legitimate update windows.

How to Mitigate CVE-2025-58979

Immediate Actions Required

Update the BerqWP searchpro plugin to a version later than 2.2.53 as soon as a patched release is available from the vendor.
If no patched version is available, deactivate and remove the BerqWP plugin from production WordPress sites.
Restrict access to /wp-admin/admin-ajax.php and plugin REST routes at the WAF or reverse proxy layer to authenticated sessions where feasible.

Patch Information

Refer to the Patchstack Vulnerability Database Entry for current patch status and vendor guidance. Administrators should apply the fixed version through the WordPress plugin update mechanism once released.

Workarounds

Block unauthenticated access to BerqWP plugin endpoints using WAF rules or .htaccess restrictions.
Enforce IP allowlisting for administrative and plugin routes on sites that do not require public API access.
Apply the principle of least privilege by disabling the plugin on sites where its functionality is not actively used.

bash

# Example WAF rule to block unauthenticated BerqWP AJAX actions
# Adjust action names to match observed BerqWP handlers
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1058979,msg:'Block unauthenticated BerqWP action'"
SecRule ARGS:action "@rx ^berqwp_" \
  "chain"
SecRule &REQUEST_COOKIES:wordpress_logged_in_* "@eq 0"