A critical privilege escalation vulnerability in the OttoKit WordPress plugin, previously known as SureTriggers, has been actively exploited in the wild. This vulnerability, identified as CVE-2025-27007 with a CVSS score of 9.8, affects all versions of the plugin up to and including version 1.0.82. The flaw arises from the create_wp_connection() function lacking a capability check and insufficiently verifying a user’s authentication credentials, allowing unauthenticated attackers to establish a connection and potentially escalate privileges.
The vulnerability is exploitable under two specific scenarios: when a website has never utilized an application password or when an attacker with authenticated access can generate a valid application password. Threat actors have been observed attempting to exploit this vulnerability by establishing a connection with the site and creating an administrative user account via the automation/action endpoint. Additionally, these attackers are also targeting CVE-2025-3102, another flaw in the OttoKit plugin that has been exploited in the wild since last month.
To protect WordPress installations from these ongoing attacks, users are urged to promptly apply the latest patches provided by the plugin developer, now available in version 1.0.83. With over 100,000 active installations of the OttoKit plugin, the timely implementation of these security updates is crucial. Attackers have been actively targeting this vulnerability since May 2, 2025, with mass exploitation beginning on May 4, 2025, as highlighted by Wordfence.
Given the severity of these vulnerabilities and the potential for widespread exploitation, WordPress site owners are advised to stay vigilant and keep their plugins and software up to date. The list of IP addresses that have been observed targeting these vulnerabilities is a reminder of the constant threat landscape faced by online platforms. By following best practices for web security and promptly addressing known vulnerabilities, users can mitigate the risks posed by malicious actors seeking to exploit flaws in popular plugins like OttoKit.
Source link