SureTriggers – All-in-One Automation Platform ≤ 1.0.78 - Authentication Bypass
CVE-2025-3102
Verified
Description
The SureTriggers- All-in-One Automation Platform plugin for WordPress is vulnerable to an authentication bypass leading to administrative account creation due to a missing empty value check on the 'secret_key' value in the 'autheticate_user' function in all versions up to, and including, 1.0.78. This makes it possible for unauthenticated attackers to create administrator accounts on the target website when the plugin is installed and activated but not configured with an API key.
Severity
High
CVSS Score
8.1
Exploit Probability
76%
Published Date
May 26, 2025
Template Author
dhiyaneshdk
CVE-2025-3102.yaml
8.1Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2025-3102
CWE ID:
cwe-697
References
https://plugins.trac.wordpress.org/browser/suretriggers/trunk/src/Controllers/RestController.php#L59https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3266499%40suretriggers%2Ftrunk&old=3264905%40suretriggers%2Ftrunk&sfp_email=&sfph_mail=https://www.wordfence.com/threat-intel/vulnerabilities/id/ec017311-f150-4a14-a4b4-b5634f574e2b?source=cvehttps://github.com/Nxploited/CVE-2025-3102
Remediation Steps
Upgrade to SureTriggers version 1.0.79 or later that properly validates the secret_key parameter.