（CVE-2025-3102）SureTriggers插件认证绕过漏洞允许创建管理员账户

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-3102
• https://www.wordfence.com/threat-intel/vulnerabilities/id/ec017311-f150-4a14-a4b4-b5634f574e2b?source=cve
• https://www.wordfence.com/blog/2025/05/recently-disclosed-suretriggers-critical-privilege-escalation-vulnerability-under-active-exploitation/
• https://github.com/Nxploited/CVE-2025-3102
• https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/suretriggers/suretriggers-1078-authorization-bypass-due-to-missing-empty-value-check-to-unauthenticated-administrative-user-creation
• https://github.com/advisories/GHSA-rp6h-6758-g8ch
• https://www.bleepingcomputer.com/news/security/hackers-exploit-wordpress-plugin-auth-bypass-hours-after-disclosure/
• https://www.rapid7.com/db/modules/exploit/multi/http/wp_suretriggers_auth_bypass/
• https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-3102
• https://zhuanlan.zhihu.com/p/1895774414550835641

Related Vulnerabilities

• WordPress SureTriggers /wp-json/sure-triggers/v1 权限绕过漏洞（CVE-2025-27007）
• PoCCVE-2025-27007: OttoKit < 1.0.83 - SureTriggers allows Privilege Escalation
• PoCCVE-2025-3102: SureTriggers – All-in-One Automation Platform ≤ 1.0.78 - Authentication Bypass
• WordPress suretriggers 存在权限绕过漏洞（CVE-2025-3102）
• WordPress Plugin Suretriggers /wp-json/sure-triggers/v1/automation/action 未授权访问漏洞（CVE-2025-3102）