CVE-2025-3102

Published Apr 10, 2025

Last updated 5 days ago

WordPress

SureTriggers

Overview

AI description

Generated using AI and has not been reviewed by Intruder. May contain errors.

CVE-2025-3102 is an authentication bypass vulnerability affecting the SureTriggers: All-in-One Automation Platform plugin for WordPress. Specifically, it resides in versions up to and including 1.0.78. The vulnerability stems from a missing empty value check on the 'secret_key' value within the 'autheticate_user' function. This flaw allows unauthenticated attackers to create administrator accounts on a target website if the plugin is installed and activated but hasn't been configured with an API key. The vulnerability was discovered by Michael Mazzolini on March 13, 2025, and a fix was implemented in version 1.0.79 of the plugin, released on April 3, 2025.

Description: The SureTriggers: All-in-One Automation Platform plugin for WordPress is vulnerable to an authentication bypass leading to administrative account creation due to a missing empty value check on the 'secret_key' value in the 'autheticate_user' function in all versions up to, and including, 1.0.78. This makes it possible for unauthenticated attackers to create administrator accounts on the target website when the plugin is installed and activated but not configured with an API key.
Source: security@wordfence.com
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Primary
Base score: 8.1
Impact score: 5.9
Exploitability score: 2.2
Vector string: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

security@wordfence.com: CWE-697

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 1