What is CVE-2025-3102?

CVE-2025-3102 is a high-severity vulnerability in Brainstormforce Ottokit: All-In-One Automation Platform, classified under Incorrect Comparison. CVSS score: 8.1/10. Published 2025-04-10.

How severe is CVE-2025-3102?

High severity. CVSS v3 base score is 8.1 out of 10.

Is CVE-2025-3102 known to be exploited?

26 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Brainstormforce Ottokit: All-In-One Automation Platform

CVE-2025-3102

The SureTriggers: All-in-One Automation Platform plugin for WordPress is vulnerable to an authentication bypass leading to administrative account creation due to a missing empty value check on the 'secret_key' value in the 'autheticate_user' function in all versions up to, and including, 1.0.78. This makes it possible for unauthenticated attackers to create administrator accounts on the target website when the plugin is installed and activated but not configured with an API key.

EPSS: 0.757 (99.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Brainstormforce Ottokit: All-in-one Automation Platform — versions 0

Weakness classification (CWE)

CWE-697 — Incorrect Comparison

Public proof-of-concept exploits

References

Frequently asked questions

What is CVE-2025-3102?: CVE-2025-3102 is a high-severity vulnerability in Brainstormforce Ottokit: All-In-One Automation Platform, classified under Incorrect Comparison. CVSS score: 8.1/10. Published 2025-04-10.
How severe is CVE-2025-3102?: High severity. CVSS v3 base score is 8.1 out of 10.
Is CVE-2025-3102 known to be exploited?: 26 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.