CVE-2025-3102
SureTriggers <= 1.0.78 - Authorization Bypass due to Missing Empty Value Check to Unauthenticated Administrative User Creation
CVE-2025-3102 is a high vulnerability (CVSS 8.1) in Brainstormforce Ottokit: All-in-one Automation Platform, published April 10, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 76.2%, the 99th percentile. No source names a fixed version.
The SureTriggers: All-in-One Automation Platform plugin for WordPress is vulnerable to an authentication bypass leading to administrative account creation due to a missing empty value check on the 'secret_key' value in the 'autheticate_user' function in all versions up to, and including, 1.0.78. This makes it possible for unauthenticated attackers to create administrator accounts on the target website when the plugin is installed and activated but not configured with an API key.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
SureTriggers <= 1.0.78 - Authorization Bypass due to Missing Empty Value Check to Unauthenticated Administrative User Creation
The SureTriggers: All-in-One Automation Platform plugin for WordPress is vulnerable to an authentication bypass leading to administrative account creation due to a missing empty value check on the 'secret_key' value in the 'autheticate_user' function in all versions up to, and including, 1.0.78. This makes it possible for unauthenticated attackers to create administrator accounts on the target website when the plugin is installed and activated but not configured with an API key.
- Record
CVE-2025-3102- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-697
- Updated
- 2026-11-02
EUVDEUVD-2025-10494
The SureTriggers: All-in-One Automation Platform plugin for WordPress is vulnerable to an authentication bypass leading to administrative account creation due to a missing empty value check on the 'secret_key' value in the 'autheticate_user' function in all versions up to, and including, 1.0.78. This makes it possible for unauthenticated attackers to create administrator accounts on the target website when the plugin is installed and activated but not configured with an API key.
- Record
EUVD-2025-10494- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-rp6h-6758-g8ch
The SureTriggers: All-in-One Automation Platform plugin for WordPress is vulnerable to an...
The SureTriggers: All-in-One Automation Platform plugin for WordPress is vulnerable to an authentication bypass leading to administrative account creation due to a missing empty value check on the 'secret_key' value in the 'autheticate_user' function in all versions up to, and including, 1.0.78. This makes it possible for unauthenticated attackers to create administrator accounts on the target website when the plugin is installed and activated but not configured with an API key.
- Record
GHSA-rp6h-6758-g8ch- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-697
- Updated
- 2026-11-02
NVD
The SureTriggers: All-in-One Automation Platform plugin for WordPress is vulnerable to an authentication bypass leading to administrative account creation due to a missing empty value check on the 'secret_key' value in the 'autheticate_user' function in all versions up to, and including, 1.0.78. This makes it possible for unauthenticated attackers to create administrator accounts on the target website when the plugin is installed and activated but not configured with an API key.
- Record
CVE-2025-3102- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-697
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | WordPress SureTriggers (aka OttoKit) Combined Auth Bypass (CVE-2025-3102, CVE-2025-27007) | 2025-03-13 |
| Nuclei | SureTriggers – All-in-One Automation Platform ≤ 1.0.78 - Authentication Bypass | |
| PoC in GitHub | 0xgh057r3c0n/CVE-2025-3102 | 2025-06-03 |
| PoC in GitHub | Nxploited/CVE-2025-3102 | 2025-04-14 |
| PoC in GitHub | SUPRAAA-1337/CVE-2025-3102 | 2025-04-25 |
| PoC in GitHub | SUPRAAA-1337/CVE-2025-3102-exploit | 2025-04-25 |
| PoC in GitHub | SUPRAAA-1337/CVE-2025-3102_v2 | 2025-04-25 |
| PoC in GitHub | baribut/CVE-2025-3102 | 2025-06-06 |
| PoC in GitHub | dennisec/CVE-2025-3102 | 2025-04-20 |
| PoC in GitHub | itsismarcos/vanda-CVE-2025-3102 | 2025-04-12 |
| PoC in GitHub | rhz0d/CVE-2025-3102 | 2025-04-14 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-02 | created | CVE List, EUVD, GitHub Advisories, Metasploit, Nuclei, NVD, PoC in GitHub |
References
wordfence.com/threat-intel/vulnerabilities/id/ec017311-f150-4a14-a4b4-b5634f574e2b?source=cve
plugins.trac.wordpress.org/browser/suretriggers/trunk/src/Controllers/RestController.php
nvd.nist.gov/vuln/detail/CVE-2025-3102
github.com/advisories/GHSA-rp6h-6758-g8ch