CVE-2025-3102: SureTriggers Auth Bypass Vulnerability

CVE-2025-3102 Overview

The SureTriggers: All-in-One Automation Platform plugin for WordPress contains a critical authentication bypass vulnerability that enables unauthenticated attackers to create administrator accounts on vulnerable WordPress installations. The flaw exists in the autheticate_user function within the plugin's REST controller, where a missing empty value check on the secret_key parameter allows attackers to bypass authentication when the plugin is installed and activated but not yet configured with an API key.

Critical Impact

Unauthenticated attackers can create administrator accounts on WordPress sites running vulnerable versions of SureTriggers, leading to complete site takeover.

Affected Products

• SureTriggers: All-in-One Automation Platform plugin for WordPress versions up to and including 1.0.78
• WordPress installations with unconfigured SureTriggers plugin
• Sites with the plugin installed and activated but lacking API key configuration

Discovery Timeline

• 2025-04-10 - CVE-2025-3102 published to NVD
• 2025-04-11 - Last updated in NVD database

Technical Details for CVE-2025-3102

Vulnerability Analysis

This authentication bypass vulnerability stems from improper comparison logic (CWE-697: Incorrect Comparison) in the plugin's authentication mechanism. When the SureTriggers plugin is installed and activated on a WordPress site but has not been configured with an API key, the secret_key stored in the system remains empty. The vulnerable autheticate_user function in RestController.php fails to validate whether the secret_key value is empty before performing the authentication comparison.

An attacker can exploit this condition by sending requests with an empty or null secret_key header value. Since both the attacker-supplied value and the stored secret are empty, the comparison succeeds, granting unauthorized access to protected REST API endpoints. This access allows attackers to invoke functionality that creates new administrator accounts on the target WordPress installation.

Root Cause

The root cause is a missing empty value check in the authentication logic within the autheticate_user function located in src/Controllers/RestController.php. The function compares the user-supplied secret_key against the stored value but does not verify that either value is non-empty before performing the comparison. This allows the authentication check to pass when both values are empty strings or null, which occurs in the default unconfigured state of the plugin.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker targets WordPress sites with the SureTriggers plugin in an unconfigured state—specifically where the plugin is installed and activated but no API key has been set. The attacker sends crafted HTTP requests to the plugin's REST API endpoints with an empty secret_key header value. Because the stored secret is also empty in this state, the authentication comparison succeeds, granting the attacker access to administrative functionality including user creation endpoints.

The vulnerability is particularly dangerous during the window between plugin installation and full configuration, which may be extended on sites where administrators delay or forget to complete the setup process. Automated scanners can easily identify vulnerable installations by probing for the SureTriggers REST endpoints and testing the authentication bypass condition.

Detection Methods for CVE-2025-3102

Indicators of Compromise

• Unexpected administrator accounts created on WordPress sites
• REST API requests to SureTriggers plugin endpoints with empty or missing authentication headers
• New user registrations with administrative privileges from unknown IP addresses
• Unusual activity in WordPress user management logs coinciding with SureTriggers API access

Detection Strategies

• Monitor WordPress REST API logs for requests targeting /wp-json/suretriggers/ endpoints with empty authentication parameters
• Implement alerting for new administrator account creation events, especially from non-standard sources
• Review access logs for patterns of reconnaissance activity probing for SureTriggers plugin presence
• Deploy web application firewall rules to detect and block authentication bypass attempts

Monitoring Recommendations

• Enable detailed logging for WordPress REST API activity and user management events
• Configure alerts for administrator account creation outside of normal administrative workflows
• Monitor for bulk scanning activity targeting WordPress plugin endpoints
• Implement real-time monitoring of critical WordPress configuration changes

How to Mitigate CVE-2025-3102

Immediate Actions Required

• Update the SureTriggers plugin to version 1.0.79 or later immediately
• Review WordPress user accounts for any unauthorized administrator accounts and remove them
• If the plugin was installed but unconfigured, either configure it with a valid API key or deactivate and remove it
• Audit access logs for signs of exploitation prior to patching

Patch Information

The vulnerability has been addressed in SureTriggers plugin version 1.0.79. The fix adds proper validation to ensure the secret_key value is not empty before performing authentication comparisons. Administrators should update through the WordPress plugin management interface or by downloading the patched version from the WordPress plugin repository. The WordPress Changeset History details the specific code changes implemented to remediate this vulnerability. Additional technical information is available in the Wordfence Vulnerability Report.

Workarounds

• Deactivate the SureTriggers plugin until it can be updated to a patched version
• If the plugin must remain active, immediately configure it with a valid API key to prevent the empty value bypass
• Implement web application firewall rules to block unauthenticated requests to SureTriggers REST API endpoints
• Restrict access to WordPress REST API endpoints at the network level where possible

# Verify current SureTriggers plugin version via WP-CLI
wp plugin list --name=suretriggers --fields=name,version,status

# Update to patched version
wp plugin update suretriggers

# Check for unauthorized administrator accounts
wp user list --role=administrator --fields=ID,user_login,user_registered

# Deactivate plugin as temporary mitigation if update not immediately possible
wp plugin deactivate suretriggers