CVE-2025-3102: SureTriggers Plugin Flaw Lets Hackers Instantly Become Admins

A high-severity flaw in the OttoKit (formerly SureTriggers) WordPress plugin is being used in attacks just hours after it was disclosed. The flaw tracked as CVE-2025-3102 lets hackers break in and create admin accounts without logging in, but only if the plugin is installed and not fully set up with an API key. That tiny misstep opens the door to total site takeover, attackers can add users, install malicious plugins, deface content, or hijack your traffic.