SureTriggers WordPress Plugin Authentication Bypass Vulnerability Allowing Unauthenticated Administrative User Creation

A vulnerability exists in the SureTriggers: All-in-One Automation Platform plugin for WordPress, in versions through and including 1.0.78. The issue arises from an authentication bypass that allows unauthenticated attackers to create administrative accounts on the target website. This vulnerability is due to a missing empty value check on the 'secret_key' in the 'autheticate_user' function. The flaw is exploitable when the plugin is installed and activated but not configured with an API key.

Impact

Exploitation of this vulnerability allows for unauthorized creation of administrative accounts on the affected WordPress site.

Remediation

Users can update to version 1.0.79 or a newer patched version to address this vulnerability.