Wordpress Plugin
CVE-2025-27007
CRITICAL
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Privilege assignment review
|
| Impact | CVSS 9.8, EPSS 84.0%, PoC available. This vulnerability is more dangerous than CVE-2025-3102 because it affects configured, actively-used installations. With over 100,000 active installations and an unauthenticated attack vector, automated exploitation campaigns are expected. |
| Exploit ScenarioDerived | An attacker sends a crafted API request to the SureTriggers endpoint that exploits the incorrect privilege assignment. They receive administrator credentials for the WordPress site. They log in, install a backdoor plugin, and begin data exfiltration of customer information, order data, and payment details from WooCommerce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 28, 2026
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unauthenticated attackers to elevate their access to administrator level. This is a separate, broader vulnerability than the earlier CVE-2025-3102, affecting more installations since it works even on configured instances.
Earlier versions of this analysis (1)
Privilege escalation in SureTriggers WordPress plugin allows unauthenticated attackers to gain admin access even on properly configured installations.
RemediationAI
Update to SureTriggers 1.0.83 or later immediately. Audit WordPress user accounts for unauthorized administrators. Review plugin installations for unknown entries. Enable WordPress activity logging to detect future unauthorized privilege changes.
Affected ProductsAI
SureTriggers: All-in-One Automation Platform <= 1.0.82
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Unlike the earlier secret_key bypass (CVE-2025-3102) which only worked on unconfigured installations, this Incorrect Privilege Assignment vulnerability affects all SureTriggers instances through version 1.0.82. The plugin's user management API contains a logic flaw that allows unauthenticated users to assign themselves the administrator role through crafted API requests.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Incorrect Privilege Assignment vulnerability in Brainstorm Force SureTriggers allows Privilege Escalation.This issue affects SureTriggers: from n/a through 1.0.82.
Executive ViewAI
Organizations using Incorrect Privilege Assignment vulnerability in Brainstorm Force SureTriggers face critical risk from CVE-2025-27007 rated CVSS 9.8. Successful exploitation could critically impact the confidentiality, integrity, and availability of affected systems. With an EPSS score of 84%, this vulnerability faces very high likelihood of exploitation. Organizations should apply vendor updates immediately when available and implement compensating controls in the interim.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Exploit-DB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
The Crypto plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.18. Rated cri
GitHub PoC