OttoKit WordPress Plugin with 100K+ Installs Hit by Exploits Targeting Multiple Flaws
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-27007 | Privilege Escalation in Brainstorm Force OttoKit WordPress Plugin (≤ 1.0.82) CVE-2025-27007 is an incorrect privilege assignment flaw (CWE-266) in the OttoKit (SureTriggers) WordPress plugin by Brainstorm Force that allows attackers to escalate privileges. Per the assigned CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N), it is exploitable remotely over the network without credentials or user interaction, making it triggerable directly against vulnerable WordPress sites. A successful attacker gains high-impact privileges — confidentiality, integrity, and availability are all rated high — effectively enabling full site compromise. Any WordPress site running OttoKit version 1.0.82 or earlier is affected, and the plugin is reported to have 100,000+ active installs. There is no public proof-of-concept and the flaw is not in CISA KEV, but EPSS puts the 30-day exploitation probability at 51.5% (99th percentile), and news reports indicate the plugin is being hit by exploits targeting multiple of its flaws. Do: Update OttoKit to the latest available release newer than 1.0.82 immediately, as all versions up to and including 1.0.82 are vulnerable. Until patched, check sites for unexpected administrator accounts or modified user roles, and consider temporarily deactivating the plugin if an update is not possible. Note that reports indicate multiple flaws in this plugin are under active exploitation, so patching and a user-account review should be treated as urgent. | 9.8 | 51% |
| large≈100,000+ WordPress sites (plugin reported at 100K+ active installs) | ||
| CVE-2025-3102 | Unauthenticated Admin Account Creation in SureTriggers/OttoKit WordPress Plugin The SureTriggers (OttoKit) All-in-One Automation Platform WordPress plugin fails to check whether the 'secret_key' value is empty in its 'authenticate_user' function, an incorrect-comparison flaw (CWE-697) that enables an authentication bypass in all versions up to and including 1.0.78. An unauthenticated attacker can trigger the flaw simply by sending requests to the affected site when the plugin is installed and activated but has not been configured with an API key. By bypassing authentication, the attacker can create new administrator accounts and achieve full administrative takeover of the WordPress site. Any WordPress site running the vulnerable plugin under those conditions is affected. Headlines report the flaw is under active exploitation in the wild, consistent with its high EPSS score of 75.9% (99th percentile), although no public proof-of-concept is listed. Do: Update the SureTriggers/OttoKit plugin to a patched release beyond 1.0.78 as soon as possible. As an interim mitigation, configure the plugin with an API key (setting the secret key) or deactivate the plugin until it can be updated. Check the WordPress users list for unfamiliar administrator accounts created recently and review authentication logs for signs of exploitation. | 8.1 | 76% |
| large≈100,000+ WordPress sites (plugin has 100k+ active installs; exploitable subset lacks a configured API key) |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| ipv4 | 107.189.29.12 | 2 41.216.188.205 144.91.119.115 194.87.29.57 196.251.69.118 107.189.29.12 205.185.123.102 198.98.51.24 198.98.52.226 199.195.248.147 |
| ipv4 | 144.91.119.115 | ties are listed below - 2a0b:4141:820:1f4::2 41.216.188.205 144.91.119.115 194.87.29.57 196.251.69.118 107.189.29.12 205.185.123.102 1 |
| ipv4 | 194.87.29.57 | below - 2a0b:4141:820:1f4::2 41.216.188.205 144.91.119.115 194.87.29.57 196.251.69.118 107.189.29.12 205.185.123.102 198.98.51.24 1 |
| ipv4 | 196.251.69.118 | :4141:820:1f4::2 41.216.188.205 144.91.119.115 194.87.29.57 196.251.69.118 107.189.29.12 205.185.123.102 198.98.51.24 198.98.52.226 19 |
| ipv4 | 198.98.51.24 | 5 194.87.29.57 196.251.69.118 107.189.29.12 205.185.123.102 198.98.51.24 198.98.52.226 199.195.248.147 Given that the plugin has ove |
| ipv4 | 198.98.52.226 | 7 196.251.69.118 107.189.29.12 205.185.123.102 198.98.51.24 198.98.52.226 199.195.248.147 Given that the plugin has over 100,000 acti |
| ipv4 | 199.195.248.147 | 18 107.189.29.12 205.185.123.102 198.98.51.24 198.98.52.226 199.195.248.147 Given that the plugin has over 100,000 active installations |
| ipv4 | 205.185.123.102 | 05 144.91.119.115 194.87.29.57 196.251.69.118 107.189.29.12 205.185.123.102 198.98.51.24 198.98.52.226 199.195.248.147 Given that the p |
| ipv4 | 41.216.188.205 | the vulnerabilities are listed below - 2a0b:4141:820:1f4::2 41.216.188.205 144.91.119.115 194.87.29.57 196.251.69.118 107.189.29.12 20 |
Full article541 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananMay 07, 2025Vulnerability / Web Security
A second security flaw impacting the OttoKit (formerly SureTriggers) WordPress plugin has come under active exploitation in the wild.
The vulnerability, tracked as CVE-2025-27007 (CVSS score: 9.8), is a privilege escalation bug impacting all versions of the plugin prior to and including version 1.0.82.
"This is due to the create_wp_connection() function missing a capability check and insufficiently verifying a user's authentication credentials," Wordfence said. "This makes it possible for unauthenticated attackers to establish a connection, which ultimately can make privilege escalation possible."
That said, the vulnerability is exploitable only in two possible scenarios -
- When a site has never enabled or used an application password, and OttoKit has never been connected to the website using an application password before
- When an attacker has authenticated access to a site and can generate a valid application password
Wordfence revealed that it observed the threat actors attempting to exploit the initial connection vulnerability to establish a connection with the site, followed by using it to create an administrative user account via the automation/action endpoint.
Furthermore, the attack attempts simultaneously aim for CVE-2025-3102 (CVSS score: 8.1), another flaw in the same plugin that has also been exploited in the wild since last month.
This has raised the possibility that the threat actors are opportunistically scanning WordPress installations to see if they are susceptible to either of the two flaws. The IP addresses that have been observed targeting the vulnerabilities are listed below -
- 2a0b:4141:820:1f4::2
- 41.216.188.205
- 144.91.119.115
- 194.87.29.57
- 196.251.69.118
- 107.189.29.12
- 205.185.123.102
- 198.98.51.24
- 198.98.52.226
- 199.195.248.147
Given that the plugin has over 100,000 active installations, it's essential that users move quickly to apply the latest patches (version 1.0.83).
"Attackers may have started actively targeting this vulnerability as early as May 2, 2025 with mass exploitation starting on May 4, 2025," Wordfence said.
Update
Patchstack, in an independent advisory, revealed that it observed exploitation attempts targeting the flaw 91 minutes after public disclosure.
"The vulnerability occurred due to a logic error in the plugin, incorrectly handling the response from the wp_authenticate_application_password WordPress function, as well as a limited amount of verification of user-provided access tokens," security researcher Chazz Wolcott said.
"Due to the behavior of this interaction, this vulnerability could lead to an attacker obtaining full control of the website via OttoKit plugin's API, including the ability to create additional Administrator-level user accounts, on any website using this plugin where the administrator has not set an application password."
OttoKit Issues Statement
In a statement shared with The Hacker News and posted on its website, the OttoKit Team said it promptly addressed the identified issues and that it found no evidence of active exploitation from its users.
"We were able to address CVE-2025-27007 swiftly through a force update in collaboration with WordPress and hosting providers, which allowed us to patch the issue before any real impact was observed," the company said in a statement. "Also for CVE-2025-3102, we have not received any reports of active exploitation from our users either."
(The story was updated after publication on July 18, 2025, to include a statement from OttoKit.)
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/05/ottokit-wordpress-plugin-with-100k.html