CVE-2025-3102

What it actually does

This is an authentication bypass in the SureTriggers WordPress plugin. In affected versions up to and including 1.0.78, the authentication routine does not properly reject an empty `secret_key` value. If the plugin is installed, activated, and not configured with an API key, an unauthenticated remote attacker can satisfy the flawed authentication check and invoke functionality that creates a WordPress administrator account. Successful exploitation gives the attacker full administrative control of the WordPress site, enabling plugin/theme modification, content tampering, user management, malware deployment, and potential server-side code execution through normal WordPress administrative capabilities.

Why it matters to the business

A compromised WordPress administrator account can result in full website takeover, defacement, malicious redirects, credential theft, SEO spam, data exposure, customer trust damage, and business disruption. Because the exploit is weaponized and EPSS is high, internet-facing WordPress sites using the vulnerable plugin should be treated as high-priority even though the vulnerable condition depends on the plugin being activated without an API key configured.

How an attack unfolds

An attacker first identifies WordPress sites with the SureTriggers plugin installed and active, commonly by probing plugin paths or REST API routes. They then test whether the plugin is in the vulnerable state where no API key or secret has been configured. If the stored secret is empty, the attacker sends a crafted unauthenticated request containing an empty or missing `secret_key` value to the plugin functionality protected by the flawed `autheticate_user` check. Because the code does not properly reject the empty value, the request is treated as authenticated. The attacker then triggers administrative user creation, logs in as the newly created administrator, and uses WordPress admin access to persist, install malicious plugins or webshells, change site content, redirect traffic, or access sensitive data available through the site.

How to fix it

Upgrade the SureTriggers plugin to a version later than 1.0.78, preferably the latest version available from the vendor or WordPress plugin repository. If an upgrade cannot be applied immediately, disable or remove the SureTriggers plugin until patched. Ensure the plugin is fully configured with a non-empty API key or secret, but do not rely on configuration alone as a substitute for patching. Review WordPress administrator accounts and remove any unauthorized users. Rotate passwords and application passwords for WordPress administrators, invalidate active sessions, and review installed plugins, themes, and modified files for persistence or malware. Where possible, restrict access to WordPress administrative and REST API surfaces using a WAF, IP allowlisting, or equivalent controls.

How to confirm the fix worked

Confirm the installed SureTriggers plugin version is greater than 1.0.78 or that the plugin is disabled/removed. In WordPress, verify through the Plugins page, WP-CLI, or filesystem metadata under `wp-content/plugins/suretriggers/`. Confirm the plugin has a valid non-empty API key or secret configured. Test that unauthenticated requests to SureTriggers-related REST API routes cannot create users or access privileged functionality. Review the WordPress user list for recently created administrator accounts, especially accounts created around the first suspicious SureTriggers request. Confirm that no unexpected plugins, themes, mu-plugins, modified PHP files, or unauthorized scheduled tasks remain after remediation.

Typical attack path

1. Scan internet-facing WordPress sites for the SureTriggers plugin or plugin-specific REST API routes.
2. Confirm the plugin is installed, activated, and running a version up to and including 1.0.78.
3. Send crafted unauthenticated requests with an empty or missing `secret_key` to the vulnerable authentication flow.
4. Abuse the bypass to create a new WordPress administrator account.
5. Log in to `/wp-admin/` using the attacker-created administrator account.
6. Use administrator privileges to install malicious plugins/themes, modify files, inject redirects, exfiltrate data, or create additional persistence.

How to detect it

Review web server, CDN, WAF, and WordPress application logs for unauthenticated POST requests to SureTriggers-related REST API or plugin paths, especially requests containing `secret_key`, empty secret values, user creation parameters, or administrator role assignment. Correlate those requests with WordPress events showing new administrator users, successful logins to `/wp-login.php` or `/wp-admin/`, plugin/theme installation, file edits, or changes to site settings. Examine WordPress user records for administrator accounts created after the plugin was installed or after suspicious API traffic. Check filesystem artifacts under plugin, theme, upload, and `mu-plugins` directories for recently modified PHP files. Look for follow-on compromise indicators such as unexpected redirects, injected JavaScript, spam pages, unfamiliar administrator accounts, unauthorized plugins, webshell-like filenames, or outbound connections from the web server after suspicious admin logins.

• /wp-content/plugins/suretriggers/
• suretriggers
• SureTriggers
• autheticate_user
• secret_key
• POST /wp-json/
• /wp-json/suretriggers/
• /wp-json/sure-triggers/
• role=administrator
• "role":"administrator"
• "administrator"
• /wp-login.php
• /wp-admin/user-new.php
• /wp-admin/plugin-install.php
• /wp-admin/theme-editor.php
• /wp-admin/plugin-editor.php
• /wp-content/mu-plugins/

What your security team should do

• Immediately inventory WordPress sites for the SureTriggers plugin and prioritize internet-facing instances.
• Patch SureTriggers to a version later than 1.0.78 or disable the plugin if patching is not immediately possible.
• Treat vulnerable, internet-facing deployments as potentially exposed because public exploitation is weaponized and EPSS is high.
• Hunt for unauthorized administrator account creation and suspicious logins following requests to SureTriggers plugin routes.
• Remove unknown administrator users, rotate administrator credentials, invalidate sessions, and review application passwords.
• Inspect plugin, theme, uploads, and mu-plugin directories for webshells or unauthorized PHP files.
• Add WAF or web server rules to monitor or temporarily block unauthenticated requests to SureTriggers REST/API endpoints until all sites are patched.
• Preserve web server, WAF, WordPress, and authentication logs before cleanup to support incident response.