CVE-2025-27007
CRITICALCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Tags
Description
Incorrect Privilege Assignment vulnerability in Brainstorm Force SureTriggers allows Privilege Escalation.This issue affects SureTriggers: from n/a through 1.0.82.
Analysis
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unauthenticated attackers to elevate their access to administrator level. This is a separate, broader vulnerability than the earlier CVE-2025-3102, affecting more installations since it works even on configured instances.
Technical Context
Unlike the earlier secret_key bypass (CVE-2025-3102) which only worked on unconfigured installations, this Incorrect Privilege Assignment vulnerability affects all SureTriggers instances through version 1.0.82. The plugin's user management API contains a logic flaw that allows unauthenticated users to assign themselves the administrator role through crafted API requests.
Affected Products
['SureTriggers: All-in-One Automation Platform <= 1.0.82']
Remediation
Update to SureTriggers 1.0.83 or later immediately. Audit WordPress user accounts for unauthorized administrators. Review plugin installations for unknown entries. Enable WordPress activity logging to detect future unauthorized privilege changes.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today