CVE-2025-3102CWE-697

SureTriggers <= 1.0.78 - Authorization Bypass due to Missing Empty Value Check to Unauthenticated Administrative User Creation

High · published April 10, 2025

Patch now

High probability of exploitation

CVSS calls it high at 8.1. It sits in the 99.5th percentile for exploit probability.

CVSS v3.1
8.1
EPSS
76%
Percentile
99.5
In the wild
Unconfirmed
What it is

The SureTriggers: All-in-One Automation Platform plugin for WordPress is vulnerable to an authentication bypass leading to administrative account creation due to a missing empty value check on the 'secret_key' value in the 'autheticate_user' function in all versions up to, and including, 1.0.78. This makes it possible for unauthenticated attackers to create administrator accounts on the target website when the plugin is installed and activated but not configured with an API key.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.76237 · 99.5th percentile
Weakness
CWE-697 · Incorrect Comparison
Published
2025-04-10T04:22Z
EPSS history
Timeline
  • 10 APR 04:22Z
    SureTriggers <= 1.0.78 - Authorization Bypass due to Missing Empty Value Check to Unauthenticated Administrative User Creation
    cvelistv5