# OttoKit: All-in-One Automation Platform <= 1.1.41 - Unauthenticated Authentication Bypass via Denied Connection Token

- **ID:** WPSEC-2026-1053
- **Plugin:** OttoKit: All-in-One Automation Platform (`suretriggers`), https://wordpress.org/plugins/suretriggers/
- **Affected versions:** all versions before 1.1.42
- **Fixed in:** 1.1.42 (Update to 1.1.42 or later.)
- **Severity:** High 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-1391
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-16)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/suretriggers
- **Fix released:** 2026-10-15
- **Published:** 2026-10-16
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1053/

## Description

The OttoKit: All-in-One Automation Platform plugin for WordPress is vulnerable to Authentication Bypass via the plugin's automation REST API endpoints in all versions up to, and including, 1.1.41. This is due to the plugin saving the fixed, publicly known string 'connection-denied' as the site's API secret when an administrator denies the OttoKit SaaS connection, and the 'autheticate_user' permission callback then accepting that value as a valid secret. This makes it possible for unauthenticated attackers to authenticate to the automation endpoints (such as automation/action) and run privileged automation actions on the site. Exploitation requires that the SaaS connection was denied on the target site and no valid connection has been made since.

## References

- https://wpsec.com/vuln/WPSEC-2026-1053/
- https://plugins.svn.wordpress.org/suretriggers/tags/1.1.42/
- https://wordpress.org/plugins/suretriggers/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1053/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.