Full Report
Flaw in SureTriggers plugin allows unauthenticated users to create admin accounts on WordPress sites
Analysis Summary
This summary is based on the provided article regarding a critical vulnerability in the WordPress plugin SureTriggers. Note that specific CVE and CVSS details were not explicitly provided in the text, so placeholders are used where necessary, inferred from the severity of the impact described.
# Vulnerability: WordPress SureTriggers Plugin Unauthenticated Arbitrary Admin Account Creation
## CVE Details
- CVE ID: N/A (Awaiting assignment or specific CVE not detailed in the summary text)
- CVSS Score: N/A (Inferred to be **High** based on immediate exploitation and administrative access)
- CWE: CWE-287: Improper Authentication (Inferred)
## Affected Systems
- Products: WordPress Plugin **SureTriggers**
- Versions: **1.0.78 and below**
- Configurations: Sites where the configured secret key handling results in a null comparison failure (i.e., sites lacking a configured secret key).
## Vulnerability Description
The vulnerability exists within the SureTriggers plugin's REST API due to improper validation of the `ST-Authorization` HTTP header. When a site does not have a secret key configured, the comparison logic evaluates both the provided header and the stored key as `null`, leading to an authentication bypass. This allows an unauthenticated remote user to exploit the flaw through specific API endpoints to create a new user account with administrative privileges.
## Exploitation
- Status: **Exploited in the wild**. Attacks were observed beginning just four hours after the patch was released.
- Complexity: **Low** (Unauthenticated, remote exploitation targeting a common configuration oversight).
- Attack Vector: **Network**
## Impact
- Confidentiality: **High** (Full site access allows access to all data).
- Integrity: **High** (Ability to create admin accounts leads to complete system takeover).
- Availability: **Medium to High** (Attackers can disrupt service or deface the site).
## Remediation
### Patches
- **Patched Version:** SureTriggers version **1.0.79** (Implied, as the article states exploitation began after patching). Users should update immediately.
### Workarounds
- **Configure a Secret Key:** Ensure the SureTriggers plugin has a security/secret key configured to force a valid comparison during authorization checks.
- **Restrict Access:** If immediate patching is impossible, restrict access to the REST API endpoints listed below via web application firewall (WAF) or server configuration rules until patched.
## Detection
- **Indicators of Compromise (IOCs):**
- Observation of POST requests to the REST API endpoints:
- `/ ?rest_route=/wp-json/sure-triggers/v1/automation/action`
- `/wp-json/sure-triggers/v1/automation/action`
- Unexpected creation of new administrative level user accounts.
- **Detection Methods and Tools:** Monitor web server and application logs for unusual activity targeting the specified REST API routes. Review WordPress user management logs for recently created, unexpected administrator accounts.
## References
- Vendor advisories (Specific vendor advisory not explicitly linked, but patches are implied).
- Relevant links - defanged:
- `infosecurity-magazine.com/news/wordpress-plugin-flaw-exploited-4/`