Description
WordPress的SureTriggers插件是一款用于自动化任务的插件，旨在简化用户的工作流程。然而，该插件的所有版本（包括1.0.78版本）中存在身份验证绕过漏洞。漏洞位于'authenticate_user'函数中，由于未对'secret_key'值进行空值检查，攻击者可以利用该漏洞在未配置API密钥的情况下创建管理员账户，从而对目标网站造成严重威胁。
WordPress Plugin Suretriggers /wp-json/sure-triggers/v1/automation/action 未授权访问漏洞（CVE-2025-3102）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2025-3102
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/suretriggers/suretriggers-1078-authorization-bypass-due-to-missing-empty-value-check-to-unauthenticated-administrative-user-creation
https://github.com/Nxploited/CVE-2025-3102
https://wptea.com/ottokit-suretriggers-wordpress-plugin-vulnerability/
https://thehackernews.com/2025/04/ottokit-wordpress-plugin-admin-creation.html
https://www.bleepingcomputer.com/news/security/hackers-exploit-wordpress-plugin-auth-bypass-hours-after-disclosure/
https://www.rapid7.com/db/modules/exploit/multi/http/wp_suretriggers_auth_bypass/
https://cn-sec.com/archives/4114221.html
https://patchstack.com/articles/critical-suretriggers-plugin-vulnerability-exploited-within-4-hours/