October 12, 2026

CyberWorldOps Cyber Security · Threat Intelligence · CVE

CVE-2025-3102

High8.1 Published on Apr 10, 2025

The SureTriggers: All-in-One Automation Platform plugin for WordPress is vulnerable to an authentication bypass leading to administrative account creation due to a missing empty value check on the 'secret_key' value in the 'autheticate_user' function in all versions up to, and including, 1.0.78. This makes it possible for unauthenticated attackers to create administrator accounts on the target website when the plugin is installed and activated but not configured with an API key.

Early warning: exploitation observed

Exploitation observed since Apr 9, 2025
Not yet in the official CISA catalogue
Attacked 1 day before the vulnerability was made public
Confirmed by sensors, not only by reports

Source: VulnCheck KEV · Oct 3, 2026 Oct 2, 2026 Oct 1, 2026 Sep 30, 2026 Sep 29, 2026 Sep 27, 2026

CVSS score8.1 / 10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness type (CWE)CWE-697

Related articles

Bricksforge WordPress flaw CVE-2026-85097 is under attack, letting anonymous visitors run PHP

Vulnerabilities

Bricksforge WordPress flaw CVE-2026-85097 is under attack, letting anonymous visitors run PHP

Attackers exploit Bricksforge flaw to upload files as PHP without login, risking site takeover. Update advised and check uploads for abuse.

Oct 12, 202611:01 5 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.