The vulnerability in the SureTriggers All‑In‑One Automation Platform plugin for WordPress arises from a missing check for an empty "secret_key" value in the authenticate_user function. Because the function skips validation when the key is empty, an attacker who can send requests to the plugin’s REST endpoint can create a new administrator account without authentication. This flaw enables an unauthorized user to gain full administrative control over the WordPress site, effectively compromising confidentiality, integrity, and availability of the site’s content and configuration. The weakness is identified as CWE-697, an authentication bypass due to an incorrect policy implementation.

The flaw affects all installations of the brainstormforce:OttoKit: All‑In‑One Automation Platform plugin (WordPress) with version numbers up to and including 1.0.78. Users who have installed and activated the plugin but have not configured an API key are susceptible to exploitation.

The CVSS score of 8.1 classifies the vulnerability as High, and the EPSS score of 88% indicates a very high likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, yet the combination of a high inherent risk and the ease of exploitation makes it a priority for immediate action. Attackers can exploit the flaw remotely by sending unauthenticated HTTP requests to the plugin’s REST endpoints, thereby bypassing authentication and creating privileged accounts.