OttoKit: All-in-One Automation Platform <= 1.1.41 - Unauthenticated Authentication Bypass via Denied Connection Token
- ID
- WPSEC-2026-1053
- Plugin
- OttoKit: All-in-One Automation Platform (suretriggers)
- Affected
- all versions before 1.1.42
- Remediation
- Update to 1.1.42 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-1391
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-16
- Attack surface
- OttoKit: All-in-One Automation Platform on WPSec AttackSurface
- Fix released
- Published
Description
The OttoKit: All-in-One Automation Platform plugin for WordPress is vulnerable to Authentication Bypass via the plugin's automation REST API endpoints in all versions up to, and including, 1.1.41. This is due to the plugin saving the fixed, publicly known string 'connection-denied' as the site's API secret when an administrator denies the OttoKit SaaS connection, and the 'autheticate_user' permission callback then accepting that value as a valid secret. This makes it possible for unauthenticated attackers to authenticate to the automation endpoints (such as automation/action) and run privileged automation actions on the site. Exploitation requires that the SaaS connection was denied on the target site and no valid connection has been made since.
References
- https://wpsec.com/vuln/WPSEC-2026-1053/
- https://plugins.svn.wordpress.org/suretriggers/tags/1.1.42/
- https://wordpress.org/plugins/suretriggers/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS