High severity8.1NVD Advisory· Published Apr 10, 2025· Updated Apr 15, 2026

CVE-2025-3102

Description

The SureTriggers: All-in-One Automation Platform plugin for WordPress is vulnerable to an authentication bypass leading to administrative account creation due to a missing empty value check on the 'secret_key' value in the 'autheticate_user' function in all versions up to, and including, 1.0.78. This makes it possible for unauthenticated attackers to create administrator accounts on the target website when the plugin is installed and activated but not configured with an API key.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Suretriggersinferred
Range: <=1.0.78
Package: https://wordpress.org/plugins/suretriggers
Suretriggers/Suretriggersllm-fuzzy
Range: <=1.0.78

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/browser/suretriggers/trunk/src/Controllers/RestController.phpnvd
plugins.trac.wordpress.org/changesetnvd
www.wordfence.com/threat-intel/vulnerabilities/id/ec017311-f150-4a14-a4b4-b5634f574e2bnvd

News mentions

No linked articles in our index yet.

cvss	0.526
epss	0.061
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000