What is the CVSS score of CVE-2025-3102?

CVE-2025-3102 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 86.6%.

Which versions of PHP are affected by CVE-2025-3102?

Organizations using All-in-One Automation Platform face notable risk from CVE-2025-3102 rated CVSS 8.1.

Is there a public PoC exploit available for CVE-2025-3102?

Yes, a public proof-of-concept exploit is available for CVE-2025-3102. Prioritise patching immediately. EPSS: 86.6%.

How to fix or mitigate CVE-2025-3102?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Monitor vendor channels for patch availability.

PHP CVE-2025-3102

HIGH

Incorrect Comparison (CWE-697)

2025-04-10 security@wordfence.com

WordPress Authentication Bypass PHP

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 18:36 vuln.today

CVE Published

Apr 10, 2025 - 05:15 nvd

HIGH 8.1

DescriptionCVE.org

The SureTriggers: All-in-One Automation Platform plugin for WordPress is vulnerable to an authentication bypass leading to administrative account creation due to a missing empty value check on the 'secret_key' value in the 'autheticate_user' function in all versions up to, and including, 1.0.78. This makes it possible for unauthenticated attackers to create administrator accounts on the target website when the plugin is installed and activated but not configured with an API key.

AnalysisAI

The SureTriggers WordPress plugin through version 1.0.78 contains an authentication bypass due to a missing empty value check on the secret_key in the autheticate_user function. On installations where the plugin API key is not configured, unauthenticated attackers can create administrative accounts and take over the WordPress site.

Technical ContextAI

The autheticate_user function compares the request's secret_key header against the stored API key using a comparison that doesn't check for empty/null values. On sites where SureTriggers is installed but not yet configured (no API key set), both the request header and stored key are empty, causing the comparison to succeed. This grants full API access, including the ability to create WordPress administrator accounts.

Affected ProductsAI

SureTriggers: All-in-One Automation Platform <= 1.0.78 OtterPress (previous name)

RemediationAI

Update to SureTriggers 1.0.79 or later. If the plugin was installed but not configured, remove it entirely. Check for unauthorized administrator accounts. Review WordPress user list for recently created admin users.