Hackers exploit WordPress plugin auth bypass hours after disclosure

Hackers started exploiting a high-severity flaw that allows bypassing authentication in the OttoKit (formerly SureTriggers) plugin for WordPress just hours after public disclosure. Users are strongly recommended to upgrade to the latest version of OttoKit/SureTriggers, currently 1.0.79, released at the beginning of the month. The OttoKit WordPress plugin allows users to connect plugins and external tools like WooCommerce, Mailchimp, and Google Sheets, automate tasks like sending emails and adding users, or updating CRMs without code. Statistics show that the product is active on 100,000 websites. Yesterday, Wordfence disclosed an authentication bypass vulnerability in OttoKit, identified as CVE-2025-3102. The flaw impacts all versions of SureTriggers/OttoKit up to 1.0.78. The flaw stems from a missing empty value check in the authenticate_user() function, which handles REST API authentication. Exploitation to be possible if the plugin is not configured with an API key, which causes the stored secret_key to remain empty. An attacker could exploit this by sending an empty st_authorization header to pass the check and grant unauthorized access to protected API endpoints. Essentially, CVE-2025-3102 allows attackers to create new administrator accounts without authentication, posing a high risk of full site takeover. Wordfence received a report about the flaw from security researcher 'mikemyers', who earned a bounty of $1,024 for the discovery in mid-March. The plugin vendor was ...