A newly disclosed high-severity safety flaw impacting OttoKit (previously SureTriggers) has come below lively exploitation inside a number of hours of public disclosure.
The vulnerability, tracked as CVE-2025-3102 (CVSS rating: 8.1), is an authorization bypass bug that would allow an attacker to create administrator accounts below sure situations and take management of vulnerable web sites.
“The SureTriggers: All-in-One Automation Platform plugin for WordPress is susceptible to an authentication bypass resulting in administrative account creation as a consequence of a lacking empty worth verify on the ‘secret_key’ worth within the ‘autheticate_user’ operate in all variations as much as, and together with, 1.0.78,” Wordfence’s István Márton said.
“This makes it doable for unauthenticated attackers to create administrator accounts on the goal web site when the plugin is put in and activated however not configured with an API key.”
Profitable exploitation of the vulnerability might allow an attacker to achieve full management over a WordPress website and leverage the unauthorized entry to add arbitrary plugins, make malicious modifications to serve malware or spam, and even redirect website guests to different sketchy web sites.
Safety researcher Michael Mazzolini (aka mikemyers) has been credited with discovering and reporting the flaw on March 13, 2025. The difficulty has been addressed in version 1.0.79 of the plugin launched on April 3, 2025.
OttoKit presents the flexibility for WordPress customers to attach completely different apps and plugins by means of workflows that can be utilized to automate repetitive duties.
Whereas the plugin has over 100,000 lively installations, it bears noting that solely a subset of the web sites are literally exploitable as a consequence of the truth that it hinges on the plugin to be in a non-configured state regardless of being put in and activated.
That mentioned, attackers have already jumped in on the exploitation bandwagon, making an attempt to shortly capitalize on the disclosure to create bogus administrator accounts with the identify “xtw1838783bc,” per Patchstack.
“Since it’s randomized it’s extremely more likely to assume that username, password, and electronic mail alias can be completely different for every exploitation try,” the WordPress safety firm said.
The assault makes an attempt have originated from two completely different IP addresses –
- 2a01:e5c0:3167::2 (IPv6)
- 89.169.15.201 (IPv4)
In gentle of lively exploitation, WordPress website house owners counting on the plugin are suggested to use the updates as quickly as doable for optimum safety, verify for suspicious admin accounts, and take away them.
Source link