SureTriggers

The discovery of the SureTriggers vulnerability, with a CVSS score of 8.1, has exposed over 100,000 websites to potential risk by allowing attackers to create admin accounts and take full control. The impact of this high-severity loophole is extensive, potentially leading to full site compromise, including uploading malicious content, SEO damage, and endangering customer data. With the exploitation beginning only hours after disclosure and the simplicity of the attack—requiring only an unconfigured API—it underscores the urgency for web administrators to secure their WordPress sites promptly.

Source: https://thecyberexpress.com/suretriggers-vulnerability/

TPRM report: https://scoringcyber.rankiteo.com/company/ottokithq

"id": "ott814041125",
"linkid": "ottokithq",
"type": "Vulnerability",
"date": "4/2025",
"severity": "85",
"impact": "3",
"explanation": "Attack with significant impact with internal employee data leaks"

{'affected_entities': [{'size': 'Over 100,000', 'type': 'Websites'}],
 'attack_vector': 'Unconfigured API',
 'data_breach': {'type_of_data_compromised': ['Customer Data']},
 'description': 'The discovery of the SureTriggers vulnerability, with a CVSS '
                'score of 8.1, has exposed over 100,000 websites to potential '
                'risk by allowing attackers to create admin accounts and take '
                'full control. The impact of this high-severity loophole is '
                'extensive, potentially leading to full site compromise, '
                'including uploading malicious content, SEO damage, and '
                'endangering customer data. With the exploitation beginning '
                'only hours after disclosure and the simplicity of the '
                'attack—requiring only an unconfigured API—it underscores the '
                'urgency for web administrators to secure their WordPress '
                'sites promptly.',
 'impact': {'data_compromised': ['Customer Data'],
            'systems_affected': ['Websites']},
 'initial_access_broker': {'entry_point': 'Unconfigured API'},
 'post_incident_analysis': {'corrective_actions': ['Secure WordPress sites '
                                                   'promptly'],
                            'root_causes': ['Unconfigured API']},
 'recommendations': ['Web administrators should secure their WordPress sites '
                     'promptly'],
 'response': {'remediation_measures': ['Secure WordPress sites promptly']},
 'title': 'SureTriggers Vulnerability',
 'type': 'Vulnerability Exploitation',
 'vulnerability_exploited': 'SureTriggers Vulnerability'}