OttoKit Meltdown: WordPress Sites Vulnerable to Hilarious Hijack!
OttoKit WordPress plugin users, beware! A vulnerability is allowing attackers to create new admin accounts, putting your site at risk. The bug, CVE-2025-3102, is due to a missing empty value check. Update to version 1.0.79 or later to stay safe, because nobody wants their site hijacked by a cyber prankster!
Hot Take:
OttoKit: the automation tool that automates your website’s demise, now with a free administrator account for hackers! Who needs complicated setup procedures when leaving it unconfigured does the trick? Now, that’s some seriously effortless automation!
Key Points:
- OttoKit, formerly SureTriggers, is a WordPress plugin with a severe authentication bypass vulnerability.
- The vulnerability, CVE-2025-3102, allows attackers to create new administrator accounts.
- This flaw can be exploited if the plugin is installed and activated but not configured with an API key.
- Defiant has urged users to update to OttoKit version 1.0.79 or later to patch the vulnerability.
- The researcher who identified the bug received a $1,024 bounty for their discovery.
Already a member? Log in here