CVE-2025-3102

The SureTriggers (OttoKit) All-in-One Automation Platform WordPress plugin fails to check whether the 'secret_key' value is empty in its 'authenticate_user' function, an incorrect-comparison flaw (CWE-697) that enables an authentication bypass in all versions up to and including 1.0.78. An unauthenticated attacker can trigger the flaw simply by sending requests to the affected site when the plugin is installed and activated but has not been configured with an API key. By bypassing authentication, the attacker can create new administrator accounts and achieve full administrative takeover of the WordPress site. Any WordPress site running the vulnerable plugin under those conditions is affected. Headlines report the flaw is under active exploitation in the wild, consistent with its high EPSS score of 75.9% (99th percentile), although no public proof-of-concept is listed.

What to do: Update the SureTriggers/OttoKit plugin to a patched release beyond 1.0.78 as soon as possible. As an interim mitigation, configure the plugin with an API key (setting the secret key) or deactivate the plugin until it can be updated. Check the WordPress users list for unfamiliar administrator accounts created recently and review authentication logs for signs of exploitation.