WordPress Websites at Risk from OttoKit Plugin Vulnerability
A newly discovered vulnerability in the popular OttoKit (formerly SureTriggers) WordPress plugin is being actively exploited in the wild, putting over 100,000 websites at risk. Tracked as CVE-2025-27007, this flaw allows unauthenticated attackers to escalate privileges and create administrator-level access on vulnerable websites.
At CybrogenIT, our cybersecurity team is urging all website owners and administrators to take immediate action to protect their WordPress installations.
🛑 What Is CVE-2025-27007?
The OttoKit plugin vulnerability (CVE-2025-27007) affects all versions up to and including 1.0.82. The issue arises from a missing capability check and insufficient authentication validation in the create_wp_connection() function.
As a result, malicious actors can:
- Bypass authentication
- Establish unauthorized connections
- Create admin-level user accounts
- Potentially take full control of your website
When Is It Exploitable?
There are two known conditions under which this vulnerability can be exploited:
- No application password has ever been enabled or used with the OttoKit plugin.
- An attacker has valid authentication credentials and can generate a working application password.
In both scenarios, attackers use the OttoKit automation/action endpoint to gain elevated access.
Additional Exploits in Play: CVE-2025-3102
In conjunction with CVE-2025-27007, attackers are also exploiting CVE-2025-3102, another flaw in OttoKit. These combined attacks suggest that automated scanning is occurring across WordPress websites to find any installations still running vulnerable versions.
🌐 Known Malicious IPs
The following IP addresses have been associated with these attacks:
makefileCopyEdit2a0b:4141:820:1f4::2
41.216.188.205
144.91.119.115
194.87.29.57
196.251.69.118
107.189.29.12
205.185.123.102
198.98.51.24
198.98.52.226
199.195.248.147
Timeline of Attacks
- May 2, 2025: Initial exploitation attempts observed.
- May 4, 2025: Mass exploitation begins.
- 91 minutes after public disclosure: Patchstack detects first wave of exploit attempts.
Security researcher Chazz Wolcott identified that the root cause involves logic flaws in how the plugin processes responses from wp_authenticate_application_password and validates access tokens. This can result in full site compromise if left unpatched.
✅ What You Should Do Now
To protect your website:
- Update OttoKit to version 1.0.83 or higher immediately.
- Enable application passwords and enforce strong credential policies.
- Audit all WordPress user accounts for unauthorized admin access.
- Block the known malicious IP addresses via firewall or security plugin.
- Schedule a WordPress security audit with CybrogenIT for peace of mind.
💡 Need help applying patches or auditing your site? Contact CybrogenIT’s cybersecurity team for immediate assistance.
🛡️ How CybrogenIT Helps
At CybrogenIT, we specialize in protecting small business websites from vulnerabilities like this. Our Managed WordPress Security services include:
- Real-time threat monitoring
- Plugin patch management
- Daily backups & malware scanning
- IP blocking & brute force protection
- Proactive threat alerts
📣 Stay Ahead of Threats
Cybersecurity doesn’t stop at updates. Follow CybrogenIT on LinkedIn and Facebook to receive real-time alerts on:
WordPress vulnerabilities
Cyberattack trends
Plugin patch notifications
Small business security tips
Don’t wait until it’s too late.
Update OttoKit today and secure your website against active exploits.