The support board plugin for WordPress contains a function that uses a hardcoded default secret key in all releases up to 3.8.0. This flaw allows an attacker with no authentication to bypass authorization checks and invoke any AJAX operation defined in sb_ajax_execute(). Because these operations can read, modify, or delete plugin data, an unauthenticated user can potentially takeover the plugin’s data store and also trigger related vulnerabilities such as CVE-2025-4828.

The affected product is the Support Board plugin developed by Schiocco, available for WordPress. All official releases numbered 3.8.0 and earlier are vulnerable. There is no other affected product listed.

The CVSS score of 9.8 reflects the high criticality of this flaw. The EPSS score of < 1% indicates that, although exploitation is unlikely to occur widely at present, the potential damage warrants immediate attention. The vulnerability is not currently listed in the CISA KEV catalog. Attackers can exploit it by sending unauthenticated HTTP requests to the plugin’s AJAX endpoint, leveraging the hardcoded key to bypass authorization. No further prerequisites are stated, so the attack vector is inferred to be a simple web request to the improperly protected endpoint.