OttoKit WordPress Plugin with 100K+ Installs Hit by Exploits Targeting Multiple Flaws

A second security flaw impacting the OttoKit (formerly SureTriggers) WordPress plugin has come under active exploitation in the wild.

The vulnerability, tracked as CVE-2025-27007 (CVSS score: 9.8), is a privilege escalation bug impacting all versions of the plugin prior to and including version 1.0.82.

“This is due to the create_wp_connection() function missing a capability check and insufficiently verifying a user’s authentication credentials,” Wordfence said. “This makes it possible for unauthenticated attackers to establish a connection, which ultimately can make privilege escalation possible.”

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

That said, the vulnerability is exploitable only in two possible scenarios –

• When a site has never enabled or used an application password, and OttoKit has never been connected to the website using an application password before
• When an attacker has authenticated access to a site and can generate a valid application password

Wordfence revealed that it observed the threat actors attempting to exploit the initial connection vulnerability to establish a connection with the site, followed by using it to create an administrative user account via the automation/action endpoint.

Furthermore, the attack attempts simultaneously aim for CVE-2025-3102 (CVSS score: 8.1), another flaw in the same plugin that has also been exploited in the wild since last month.

This has raised the possibility that the threat actors are opportunistically scanning WordPress installations to see if they are susceptible to either of the two flaws. The IP addresses that have been observed targeting the vulnerabilities are listed below –

• 2a0b:4141:820:1f4::2
• 41.216.188.205
• 144.91.119.115
• 194.87.29.57
• 196.251.69.118
• 107.189.29.12
• 205.185.123.102
• 198.98.51.24
• 198.98.52.226
• 199.195.248.147

Given that the plugin has over 100,000 active installations, it’s essential that users move quickly to apply the latest patches (version 1.0.83).

“Attackers may have started actively targeting this vulnerability as early as May 2, 2025 with mass exploitation starting on May 4, 2025,” Wordfence said.

Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post.