CVE-2025-3102: brainstormforce ottokit: all-in-one automation platform Incorrect Comparison
Vulnerability summary
CVE-2025-3102 is a high (CVSS 8.1) Incorrect Comparison vulnerability in brainstormforce ottokit: all-in-one automation platform. EPSS estimates a 76.24% chance of exploitation in the next 30 days, higher than 99.5% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 1.0.79.
Timeline
- 10-04-2025PublishedVulnerability first disclosed.
- 08-04-2026Last modifiedVulnerability information updated.
Description
The SureTriggers: All-in-One Automation Platform plugin for WordPress is vulnerable to an authentication bypass leading to administrative account creation due to a missing empty value check on the 'secret_key' value in the 'autheticate_user' function in all versions up to, and including, 1.0.78. This makes it possible for unauthenticated attackers to create administrator accounts on the target website when the plugin is installed and activated but not configured with an API key.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- wordfenceSource8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
76.24%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
0.00 pp
From 76.24% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundWordPress SureTriggers (aka OttoKit) Combined Auth Bypass (CVE-2025-3102, CVE-2025-27007)
exploit/multi/http/wp_suretriggers_auth_bypass
Maturity: weaponized
Weaknesses
CWE · root causeAffected systems
Brainstormforce1 product
- ottokit: all-in-one automation platform≤ 1.0.78
Wordpress1 product
- suretriggers≤ 1.0.78 (fixed in 1.0.79)
2 vendors · 2 products