The vulnerability in the SureTriggers All‑In‑One Automation Platform plugin for WordPress allows an unauthenticated attacker to create an administrator account because the plugin's authentication routine fails to verify that the 'secret_key' field is non‑empty before proceeding. This bypass is a classic authentication bypass (CWE‑697). The attacker can then obtain full control over the WordPress site, compromising the confidentiality, integrity, and availability of its content and configuration.

The flaw affects all WordPress installations that have the SureTriggers: All‑In‑One Automation Platform plugin version 1.0.78 or earlier. Users who have installed, activated the plugin and left the API key field empty are susceptible. The issue does not exist in versions newer than 1.0.78 according to the existing patch.

The CVSS base score of 8.1 indicates high severity. The EPSS score of 84% suggests a very high likelihood that this flaw will be exploited in the wild. The vulnerability is not in the CISA KEV catalog, but the combination of high inherent risk and ease of exploitation makes it an immediate priority. Attackers can exploit the flaw remotely by issuing unauthenticated HTTP requests to the plugin’s REST endpoint, thereby bypassing authentication and creating privileged accounts. Based on the description, it is inferred that the exploitation requires only unauthenticated HTTP requests to the plugin’s REST endpoint.