Hackers Exploit OttoKit WordPress Plugin to Create Rogue Admins

Hackers exploit OttoKit WordPress plugin to create rogue admins

Summary

• OttoKit Vulnerability: A flaw in the WordPress plugin lets attackers create administrator accounts without logging in.
• Impact Scope: The plugin, formerly called SureTriggers, runs on more than 100,000 sites.
• Exploitation: Attackers began trying the flaw within hours of public disclosure.
• Mitigation Measures: Version 1.0.79 fixes it; site owners should update and check for unknown admin accounts.
• Who Is Exposed: Sites with the plugin active but no API key configured.

An authentication bypass in OttoKit

OttoKit, formerly SureTriggers, is a WordPress automation plugin that connects sites to other apps and services. A flaw tracked as CVE-2025-3102 lets attackers create administrator accounts without credentials on vulnerable sites.

Which sites are at risk

The plugin is installed on more than 100,000 sites. The bug only bites when the plugin is active but has no API key configured, and in that state a missing check lets an attacker pass authentication with an empty value. Then they create an admin.

How the flaw came to light

The flaw was found by researcher Michael Mazzolini and reported through Wordfence’s bug bounty program. A fix shipped on April 3, 2025. Attackers started trying to exploit it within hours of public disclosure, according to security firm Patchstack.

What attackers do with it

Attackers send crafted requests to the plugin’s REST endpoint to create new administrator accounts. Admin rights mean everything: malicious plugins, changed content, stolen data or backdoors that sit unnoticed for months.

What site owners should do

Update OttoKit to version 1.0.79 or later. Then check the site’s user list for administrator accounts you did not create, and review recent plugin installs.

Ongoing hygiene

Keep plugins updated and remove ones you no longer use. Keep restorable backups.

Lessons from OttoKit

The speed of exploitation is the lesson. Attackers watch vulnerability disclosures and move within hours, so sites that wait days to update are exposed.

Turning on automatic updates for trusted plugins is the simplest defense.

Fred Templeton, CISA, CASP, SEC+

Fred Templeton is a practicing Information Systems Auditor in the Washington DC area. Fred works as a government contractor and uses his skills in cyber security to make our country's information systems safer from cyber threats. Fred holds a master's degree in cybersecurity and is currently working on his PHD in Information Systems.