Overview
A critical privilege-escalation vulnerability has been disclosed in OttoKit (formerly branded SureTriggers), the automation/integration plugin from Brainstorm Force used by WordPress sites to connect forms, CRMs, and other tools via no-code workflows. Tracked as CVE-2026-110372 with a maximum-impact CVSS score of 9.8, the flaw stems from incorrect privilege assignment and lets an unauthenticated attacker escalate privileges on an affected site — with no login, password, or user interaction required.
The plugin has a documented history on this front: an earlier, separate bug in the same plugin (CVE-2025-27007) exposed over 100,000 sites to unauthenticated admin-account creation via a REST endpoint and was actively exploited in the wild. CVE-2026-110372 is a distinct issue in the same codebase — security teams tracking the earlier incident should not assume that fix also covers this one.
Technical Details
| Field | Value |
|---|---|
| CVE ID | CVE-2026-110372 |
| Severity | Critical (CVSS 9.8) |
| CWE | CWE-269 — Improper Privilege Management |
| Attack Vector | Network |
| Authentication | None Required |
| Privileges Required | None |
| User Interaction | None |
| Impact | Full confidentiality, integrity, and availability compromise |
| Affected Versions | OttoKit (SureTriggers) through 1.1.40 |
| Fixed Version | Not yet published at time of writing — verify current release before assuming patched |
How It Works
OttoKit's plugin logic assigns and checks user privileges when its automation triggers and connections are configured and invoked. CVE-2026-110372 arises because the plugin does not correctly assign, track, or verify the caller's privilege level at one or more of these control points — classified under CWE-269, "Incorrect Privilege Assignment." An attacker who can reach the plugin's endpoints without ever authenticating can exploit this gap to obtain elevated privileges on the WordPress install, with the scoring vector (AV:N/AC:L/PR:N/UI:N) indicating the attack is remote, low-complexity, and needs no credentials or clicks from a victim.
No public proof-of-concept or technical write-up has surfaced yet, and ease-of-exploitation is currently assessed from the CVSS vector rather than a demonstrated exploit chain. Given the plugin's prior track record of being exploited within days of disclosure, that absence of public detail should not be read as low risk.
Impact Assessment
Who Is At Risk
Any WordPress site running the OttoKit (SureTriggers) plugin at version 1.1.40 or earlier is potentially affected, including sites that:
- Use OttoKit to wire up automations between WordPress and third-party apps (CRMs, email platforms, payment processors)
- Have the plugin active but rarely audited, since automation plugins are often "set and forget"
- Previously remediated CVE-2025-27007 and assumed the plugin was fully hardened as a result
Potential Attack Chains
- Unauthenticated Access — Attacker reaches a vulnerable OttoKit endpoint without any credentials
- Privilege Escalation — Attacker exploits the incorrect privilege check to act with elevated permissions
- Site Takeover — Elevated access is used to create administrator accounts, install additional plugins, or directly modify site content and configuration
- Downstream Abuse — A compromised WordPress site is repurposed for malware distribution, SEO spam, or as a pivot point into connected third-party services OttoKit integrates with
Mitigation
Immediate Actions
- Check your installed OttoKit version now. Sites running 1.1.40 or earlier should treat this as urgent given the unauthenticated, zero-interaction attack path.
- Watch for a vendor patch release and update the moment one ships — subscribe to the plugin's WordPress.org changelog or Brainstorm Force's advisories.
- If a patch is not yet available, consider deactivating OttoKit on production sites until a fixed version is confirmed, particularly on sites that also handle sensitive customer data through connected integrations.
Detection Opportunities
- Review the WordPress user list for unexpected new administrator or editor accounts
- Check OttoKit's connection/trigger logs for activity that does not correspond to a known, authenticated administrator session
- Monitor web server access logs for repeated or automated requests to OttoKit's REST/API routes
Defence-in-Depth
- Apply the principle of least privilege to any plugin that exposes REST endpoints or webhook receivers
- Run a web application firewall (WAF) capable of virtually patching known WordPress plugin CVEs ahead of an official fix
- Maintain an inventory of installed plugins and their versions so newly disclosed CVEs can be triaged quickly against your actual exposure
Discovery & Disclosure
CVE-2026-110372 was reserved and published around October 14–18, 2026, with the advisory attributed to Patchstack's WordPress vulnerability research program. As of publication, the issue is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog and no public exploit is known to exist, but the unauthenticated, no-interaction attack path and the plugin's prior exploitation history both argue for treating this as a drop-everything patch once a fix ships.