BaseFortify

Publication date: 2025-04-10

Last updated on: 2026-06-17

Assigner: Wordfence

Description

The SureTriggers: All-in-One Automation Platform plugin for WordPress is vulnerable to an authentication bypass leading to administrative account creation due to a missing empty value check on the 'secret_key' value in the 'autheticate_user' function in all versions up to, and including, 1.0.78. This makes it possible for unauthenticated attackers to create administrator accounts on the target website when the plugin is installed and activated but not configured with an API key.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-04-10

Last Modified

2026-06-17

Generated

2026-10-16

AI Q&A

2025-04-10

EPSS Evaluated

2026-10-14

NVD

CVE-2025-3102

EUVD

EUVD-2025-10494

Affected Vendors & Products

Vendor	Product	Version / Range
brainstormforce	OttoKit:	All-in-One Automation Platform 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-697	The product compares two entities in a security-relevant context, but the comparison is incorrect.

Attack-Flow Graph

Executive Summary

The vulnerability exists in the SureTriggers: All-in-One Automation Platform plugin for WordPress. Because of a missing check for an empty value in the 'secret_key' passed to the authenticate_user function (in versions up to and including 1.0.78), an attacker does not need proper credentials to bypass authentication. This flaw allows an unauthenticated attacker to create an administrative account on a target website when the plugin is installed and activated but not configured with an API key. [1]

Impact Analysis

If you are using the SureTriggers plugin and have not configured it with the required API key, an attacker can exploit this vulnerability to create an administrator account on your website. This unauthorized access can lead to full control over your site, potential compromise of sensitive data, and could result in significant security breaches. [1]

Hi! I’m here to help you understand CVE-2025-3102. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70