Support Board WordPress Plugin Unauthenticated Authorization Bypass Vulnerability

A vulnerability exists in the Support Board plugin for WordPress, all versions through 3.8.0, allowing unauthorized access, modification, or deletion of data. This issue arises from hardcoded default secrets in the sb_encryption() function, which enable unauthenticated attackers to bypass authorization and execute arbitrary AJAX actions defined in the sb_ajax_execute() function. Exploitation of this vulnerability could also facilitate the exploitation of CVE-2025-4828 and other unauthenticated functions.

Impact

Exploitation of this vulnerability allows for unauthorized access and manipulation of data within the WordPress site, including the potential to exploit other vulnerabilities such as CVE-2025-4828.

Remediation

Users are advised to update the Support Board WordPress plugin to version 3.8.1 or a newer patched version.